FEDKRAL BUREAU OF INVESTIGATION 
FOI/PA 
DELETED PAGE INFORMATION SHERT 
FOI/PA# 1325219-0 


Total Deleted Page(s) = 65 
Page 17 ~ b6; b7C; b7E; 
Page 18 ~ b6; b7C; b7E; 
Page 19 ~ b6; b7C; b7E; 
Page 20 ~ b6; b7C; b7E; 
Page 21 ~ b6; b7C; b7E; 
Page 22 ~ b6; b7C; b7E; 
Page 23 ~ b6; b7C; b7E; 
Page 24 ~ b6; b7C; b7E; 
Page 25 ~ b6; b7C; b7E; 
Page 26 ~ b6; b7C; b7E; 
Page 28 ~ Duplicate; 


Page 29 ~ Duplicate; 
Page 30 ~ Duplicate; 
Page 31 ~ Duplicate; 
Page 45 ~ Duplicate; 
Page 46 ~ Duplicate; 
Page 74 ~ Duplicate; 
Page 75 ~ Duplicate; 


Page 76 ~ Duplicate; 
Page 77 ~ Duplicate; 
Page 79 ~ b6; b7C; b7E; 
Page 80 ~ b6; b7C; b7E; 
Page 83 ~ Duplicate; 
Page 84 ~ Duplicate; 
Page 85 ~ Duplicate; 
Page 86 ~ Duplicate; 
Page 87 ~ Duplicate; 
Page 88 ~ Duplicate; 
Page 89 ~ Duplicate; 
Page 90 ~ Duplicate; 
Page 94 ~ Duplicate; 
Page 95 ~ Duplicate; 


Page 121 ~ Duplicate; 
Page 122 ~ Duplicate; 
Page 123 ~ Duplicate; 
Page 124 ~ Duplicate; 
Page 131 ~ Duplicate; 
Page 132 ~ Duplicate; 
Page 141 ~ Duplicate; 
Page 142 ~ Duplicate; 
Page 143 ~ Duplicate; 
Page 144 ~ Duplicate; 
Page 159 ~ Duplicate; 
Page 160 ~ Duplicate; 
Page 178 ~ Duplicate; 
Page 179 ~ Duplicate; 
Page 180 ~ Duplicate; 
Page 181 ~ Duplicate; 


Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 


189 
190 
191 
192 
193 
202 
203 
204 
205 
206 
207 
213 
214 
215 
216 
217 
218 


GVDUUVUT7VUUVUVTVUUVVY 
G 
re) 


iw) 
G 
°'O 


licat 
licat 
licat 
licat 


Le; 
Le; 
Le; 
Le; 


b7G; DE; 


licat 
licate; 
licat 
licate; 


LE; 


LE; 


b7C; b7E; 
b/G>-b/Ee 


licate; 
licate; 
licate; 
licate; 


b7C; b7E; 
biG? b/EHe 


XXXXXXXXKXKXXK XX KK XX XK XXX 


x Deleted Page(s) »4 
4 No Duplication Fee X 
Xx For this Page Xx 


XXXKXKXXKXAXKX KA KK AR KRAKXKXAKRAX KAKA 


ee SSRs dee 
aspentenrssern os 3 ot ee 


A ee 


Reares oes a Sitice at Dugin PRE Tetetiganye © ane 


_AUBEANDRIA - Sees _ -RLEXANDRIA, ery Euan | ‘B/28/ 3 2pufea 


Bic ay te oie 
. 


PROSECUTIVE 


we 


ae REEESENCES Alexandria teletype to the Bureau dated. 8/27/8 Bere 


ADMINISTRATIVE: , Ee 
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AX 196A-633 
35.) 

again uses the 
36.) 
37.) 
38.) 
39.) 
40.) 
41.) 


states "Well I 
new board. It 


September_8, 1983, 
true name|___| 


3:21 PM. This message Be 


September 
September 
September 
September 
September 


September 


figured out what 


9, 

12, 
12, 
12, 
13, 


15, 


1983, 
1983, 
1983, 
1983, 
1983, 


1983 


8:32 AM. 
12:40 PM. 
4:34 PM. 
9:28 PM. 


10:13 AM. 


1:45 PM. This message 
[__]aia, and I found his 


is on this. (a different company). We (not 


him) are now under Lincom, a division I created, so_we b6 
are isolated (a little) from _both the main co. and b7c 
Talk to you later, "This message indicates 
that has _ set up his_own illegal node in a new company, 
and were previously illegal 


users in the legitimate user known as RADA. 


42.) September 15, 1983, 1:43 PM. 

43.) September 16, 1983, 1:56 PM. This message 
refe Pat (indicating his roommate ) b6 
and (indicating ° b7c 

44.) September 16, 1983, 1:05 AM. 

45.) September 16, 1983, 2:03 PM. 

46.) September_18, 1983, 1:28 AM. This message b6 
again uses the true name[__and the true name 7 

47.) September 18, 1983, 1:36 PM. 

48.) September 18, 1983, 11:17 AM. 

49.) September 19, 1983, 1:39 PM. 

50.) September 20, 1983, 8:46 AM. 

51.) September 20, 1983, 10:23 AM. 

eer 


Alle 


AX 196A~-633 5 


52.) September 20, 1983, 10:38 AM. 

53.) September 20, 1983, 11:18 AM. 

54.) September 20, 1983, 3:46 PM. 

55.) September 20, 1983, 2:29 PM. 

56.) September 21, 1983, 7:33 PM. 

57.) September 22, 1983, 10:20 AM. This message 
states in part "Who knows, anyway_we have been terrorizing 
the parking lot with the laser.[ ~~ window has a good 
view of the parking lot, so we just aim it at peoples 
feet and they can't figure out what the hell is going 
on. The beam does diverge a little, for example, at 200 

yards or so, it is about five inches wide. But it still 
gives a good effect." 

58.) September 22, 1983, 10:35 AM. 

59.) September 22, 1983, 9:03 PM. 

60.) September 23, 1983, 3:56 PM. 

61.) September 24, 1983, 6:06 PM. 

62.) September 26, 1983, 12:30 PM. 

63.) September 27, 1983, 12:29 AM. 

64.) September 27, 1983, 12:32 AM. 

65.) September 28, 1983, 12:31 PM. 


66.) September 29, 1983, 12:56 PM. This _ message 


states { 4 it looks like we had to move. is 
and can be sent mail. is password: Bright. 
Talk to you later. "This indicates that these 


illegal users have now moved to yet a third company, 3M 
Corporation. 


67.) September 29, 1983, 2:58 PM. 


68.) September 29, 1983, 3:11 PM. 


AI" 


b6 
b7C 


b6 
b7Cc 
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69.) October l, 
70.) October 2, 
71.) October 3, 
uses the true name 
72.) October 2, 
73.) October 3, 
74.) October 3, 
75.) October 3, 
76.) October 4, 
77.) October 5, 
78.) October 5, 
79.) October 5, 
80.) October 5, 
81.) October 7, 
82.) October 7, 
83.) October 10, 
84.) October ll, 
85.) October 10, 
86.) October 9, 
87.) October 11, 
88.) October il, 


& 


1983, 
1983, 


1983, 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 


1983, 


10:29 PM. 
3:04 PM. 


12:33 AM. 


3211 PM. 
1:20 PM. 
4:47 PM. 
7:28 PM. 
2:21 PM. 
12:27 PM. 
4:52 PM. 
12:32 PM. 
5:06 PM. 
1:04 AM. 


83:40 AM. 


1:30 PM.. 


2:14 PM. 
1:54 PM. 
1:55 PM. 
2:02 PM. 


1:58 PM. 


A\E 


This message 


b6 
b7Cc 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/18/8 4 


followin b6é 
The following evidence is that pic 
w 
(1) A green note paper with handwritten 
instructions on how to change passwords on 
a Telemail account. 
(2) A shee bearing the Telenet dial-up b6 
number and a Telenet 800 number, b7c 
800424-9494, 
(3) A New York telephone bill for number 
dated September 13, 1983. 
This bill contains humerous phone calls to am 
area_code ome phone 
of aka, 


(4) This is a computer printout of all the 
administrators of Telemail customers. 


(S) This is a computer printout of numerous na b6 
aud: addrocses Seqiuning with| 7 <— ae 
(6) This is a multi-page computer printout. 
On the back of the computer printout is 


found numerous handwritten user names 
associated with the illegal use of Telemail. 


(7) This is a Panasonic video cassette on which 
icnic sponsored b 
in 
aka, 


this picnic. On this tape rene b6 
at approximately counter numb b7c 
tape camera is pointed toward ae 


the person taking the picture says, "There's 
replied, "Yes," and the camera pans away from him. 


Al isnuned vA. 


inveGanangel Le’ 23783 aethi-ean—New. York- cite «Alexandria 
196A-633 Sub J 
by SA lw Date dictatea__ 12/23/83 BS 


b7C 


This document contains neither recommendations nor conciusions of the FBI. It is the property of the FBI and is loaned to your agency; 


AN 


it and its contents are not to be distributed outside your aie 


AX 196A-633 Sub J 2 


You can then he sa "You misspelled 
my name, it's then says, 
is wanted by the FBI. No kidding!" 


Lad 


b6 
b7Cc 


INCIDENT REPORT “© 
nazarelh DEPARTMENT OF SECURITY AND SAFETY | : 


COMPLAINT No, 


yo 8@ | ef 
IN 


NATURE OF INCIDENT ; 
Telerhone Fraud Investigation 
DATE / TIME REPORTED 


10-6-83 1100hrs 


OATE/TIME OCCURED 
9-7-83(See Relow) 

NAME OF COMPLAINANT OR VICTIM 
Nazareth College of Rochester 

ADDRESS / STREET No. 

4245 East Avenue 


Smyth Hall, Rm/322, Math Labs. 


WITNESS (ES) NAME 


City STATE ZiP 
Rochester N.Y. 14610 
BUSINESS PHONE EXT. No. 
| 586-2525 | | 
SEX DATE OF MONTH DAY YEAR ADORESS /STREET No. 
BIRTH 
n/a n/a 


PENAL LAW SECTION OR COLLEGE CODE 


NARRATIVE DESCRIFTION 


(1) Summarize details of incident (2) Oescribe physical evidence or 
Property found and dispcsition (3) Describe injuries, give Ooctor’s 
name, Hospital nama, etc. (4) Pescription of suspects i5} Names of DATE OF MONTH 
additional witnesses BIRTH 


reported that{ 
of is monthly telephone Bi Tor oep- 
tember, with questionable calis to six long distance locations, in and 
out of the country, not authorized by he or anyone in his department. 
The telephone number that the calls originated from are computer phones 
in the Math Lab. One private number is and the other is 
The calls were made from the latter number. They are as follows: 


b6 
b7C¢ 


INCIDENT REPORT 


COPIES NOT TO BE MADE WITHOUT APPROVAL OF THE DIRECTOR OF SECURITY 


#3 - Prince Ceorre, Rritish Columbia 


#4 - Prince George, British Columbia 
-L | 


#6 - Renner Texas 


Ti (See attached telephone bill) 

<{ 

50 The telephone calls were all made on Wednesday, September 7, 1983 
-3 between the hours of 2:44PM and 4:27PM while the math labs were open 

=a for use by students. 

=> 

-E aieataeeeietetateates a eteiteetatal INVESTIGATION TO CONTINUE ----------~------------ 

co 
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aw ; ; 

Lf P=29 b6é 

= TT b7C 
& | . O civic AutHORriy O croses 

Some REFERRED TO TOK nteen at 

Cr O Not REQUIRED AAIl- | 

e) Loner orRE—————— | REPORTING OFICER ZZ PBAOCE No 
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NMG | © @prrementat INCIDENT ey COMPLAINT No. 
azarelh | ee 


DEPARTMENT OF SECURITY AND SAFETY 


PAGE OF 


NATURE OF INCIOENT 


Telephone Fraud Investigation 
DATE/TIME OCCURED DATE/TIME REPORTED 


9-7-83 10-6-83 1100 hrs 


NARRATIVE 


(1) Summarize details of incident (2) Describe ohysica! evidence or 
property found and disposition (3) Describe injuries, give Doctor’s 
name, Hospital name, etc. (4) Description of suspects (5) Names of 
additional witnesses 


-7-83 It_ was learned that the call tol sida listed to 
residence and that a return call from that telephone nuz- 
er to_a telephone number in had_been made. That num- 6 
i £ 


the residence of 


anne nena ne- ~----- INVESTIGATION TO CONTINUE -------------------------- 


10-20-83 -Television station WOKR first broke the news thac[ __ 
[had been questioned by asents 
t 


aca. and ccmputer aqui pment |, and confiscated from his room. 
This according to the media coverage occurred on October 12, 1983 at 


Cs _The students involved in tnis 
Yald were thoueht to be a part of a nationwide ring who allegedly got 


into the Telemail computers_in Alexandria, Va. (See Attached articles) pbé6é 
I contacted Special fgent| __|o£ the Roche ffice of the FBI pb7c 
for further information as apprehension of and also 
at Cornell, who referred me 

ice of the FBI. Agent 
(1-607-272- -6424) 


p 
ae as a nice kid, very coopera- 
tive, understandi ted that he had also spoken via telephone 


to the parents in who were wonderful people. He stated the 
youth was not charged but the equipment was confiscated and that charges 
- May be pressed in the future. 
Agent 


suggested I talk to the parents and{ ______} 
and felt that would be cooperative shou Is attorney b6 
allow him to talk to me, of our_computer center in b7C 
along with[.—sdJwere both 


Smyth Hall basement and 
notified of the investigation. - oe 


SUPPLEMENTAL INCIDENT REPORT 


copies NOT TO BE MADE WITHOUT APPROVAL OF THE DIRECTOR OF SECURITY 


On this date, I telephoned residence and spoke to 
and later to were cordial, though 
Suspicious at first due to the calls from the media. They described 


their only son as a straight honest boy _w j committing 


an offense but_was given the number by 
= firho 


b7¢ 
, here over the surmer to meet 
“It would be impossible, according to for 
1 £ h ecause 


ater this month after the pub ieity 


STATUS ———"TaabDGe Now No, 
Pe Gore evo ery ESI 
Rom Dex il [—] * 


NA<OFretiy SECURITY AND SAFETY 


DEPARTMENT CF : 
SECURITY AND SAFETY SUPPLEMENTAL INCIDENT REPORT 
copics NOT TO BE MADE WITHOUT APPROVAL OF THE DIRECTOR OF SECURITY 


eth 


nazare 


. 


. a4 co @Prcementar INCIDENT eg po 
_dearelh DEPARTMENT OF SECURITY AND SAFETY , —— 


‘ : PAGE OF 
we 
NARRATIVE 
DATE/TIME OCCURED DATE/TIME REPORTED (1) Summarize dotaifs of incident (2) Describe paysical avidence cr 
propeity found anu disposition (3) Describa injures, giva Doctor's 
9-7 -~83 10-6 -83 1100 hrs name, Hospital name, etc. (4) Description of suspects (5) Names ot 


additional witnesses. 


} 


subsides. Both_stated that he has cooperated fully with the FBI and ac- 

cording to Agt. ‘felt that he would cooperate with us. b6 
‘ b7C 

See eee See SSS eee e ete se Investigation to Continue -------- as ao 


The incomplete roster of those using the room on the date in 
question, showed the names of only four persons that afternoon, and 
they are: 


rasiding in home address: 
home phone: 6 
Residing in home address - me 
Tome phone 
b6 
. b7C 
eS the Admissions office is also taking a course but 
was not able fo use the computer room that day, nor during business 
hours 
morte enn rer et eenenn Investigation to Continue ---------------------- 
Copies to: 
te b6 
b7C 
Special Agent -~ Rochester FBI Office 
Special Agent - Ithaca FBL Office b6 
with extra copy for Special Agent bic 


originating case agent in Alexandria, Virginia 


Neen en nee ee en eed 


STATUS 
3K OPEN (10 cLoseo 


wr to MIO TOMS ASN MULATSIEN.N FT bsteg 


rar Sl PHONES: CALL 955=7 70 “BILL Us T= 


” STB 
( 
PLEASE PAY BY 
- PAST DUE AMOUNT O aa) oe 


L NEW CHARGES PAY THIS AMOUNT (SEE BACK OF BILL) 
200 


-- 53.00/] oct 14 198 


ay oe : 


pi ACCT. FSG ee? 


Dept. a 


NAZARETH COLLEGE APPROVAL F rm i 

4245 EAST AVE: SEES LOR PAYMENT 

ROCHESTER NY 14618 Dept. Head oH Date _Fje i 
Comptroller Date H 


Treasurer Date 


Paid 
Check # 
BALANCE FROM PREVIOUS BILL 08=19=8 Date Saat + G 


MONTHLY SERVICE 09819 THROUGH 1018 


62 METERED CALLS 5202 
GROSS REVENUE SURCHARGE 1.21 
: ‘ = 

LONG DISTANCE CALLs 
~#_D LACE LU! “TIME_MIN R CHARGE 

1 0907 -244P 90 4616 

2 0907 301P- 23 0 14.43 ee 
3 O907 PRINCEGRGEBC €04=562=9515 410P 1-0 ° 89 nae 
4 0907 PRINCEGRGEBC  604"562=9515 411P 1 0 89 

5 0907 412P 30 1.14 

6 0907 RENNER TX 214"931=3437 427P 10 __ 264 

TOTAL LONG DISTANCE CHARGES 22015 22.15 

TOTAL TAXES FED .00 ST/LOCAL .00 206 


PLEASE PAY THIS AMOUNT BY 10-14. “  53.0C 


o. 


SEE REVERSE FOR INFORMATION ASOUT LONG DISTANCE CALLS, 
PAYMENTS AND LATE PAYMENT CHARGES 


foo~N, - 
nazarelh 


# Date Place Called Number Called & Party Time Min. Charcze 
9/7/83 [__ Cd 2:44P 9 $4.16 
(Non- Pub) pre 
2. 9/7/83 Lid | 017 23 $14.43 
: L r ine for — 
3. 9/7/83 Prince George, 604-562-9515 4:10P 1 $ 89 
. British Columbia Auxilliary Line for(562-9513) 


Native Court Records 


4. 9-7-83 Prince George, 


British Columbia Same as above 4:11P 1 $ .89 
5. 9-7-83 f 4:12P 3 $1.14 be 
. b7C 
6. 9-7-83 Renner, Texas 214-931-3437 4:27P 1 $ .64 
Helco Commodity Research 
(Auxilliary Number Division of Clayton 
931-3252) Brokerage Company of . 
St. Louis ‘ 


, TOTAL $22.15 
All. calls placed on Wednesday, September 7, 1983 between 2:44PM and 4:Z7Pit 
from 586-4773 to the above numbers and listings. 


e343" 


NAZARETH COLLEGE OF ROCHESTER » 4245 EAST AVENUE - ROCHESTER, NEW YORK 14610 - 716 586-2525 


mae NR Ae ae ante vn oe Oa estlcete ~ . 
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FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


1 1/9/84 


Date of transcription 


The following is a summary of messag left 
on the GTE Telemail System by the illegal a b6 
The format of this summary will be as follows: e time Bac 
and date of each message will be stated, with a synopsis 
of the message if it is deemed particularly significant 
or contains incriminating statements. 
1.) September 3, 1983, 1:34 PM (all times Eastern 
Daylight Time). 
2.) September 5, 1983, 11:35 PM. Mess reads: bé 
Harry, what do you think happened to éignea[. | p7c 
3.) September 9, 1983, 9:37 AM. 
4.) September 10, 1983, 12:31 PM. 
5.) September 10, 1983, 12:33 PM. 
6.) September 10, 1983, 7:08 PM. 
7.) September 10, 1983, 9:23 PM. 
8.) September 11, 1983, 1:19 AM. This message 
reads in part: "Also if you want to test out 2600 Hz, ne 
call There's a ‘number changed' recordin ie 
that you can cer-chunk off of if you want. Signed|- 
9.) September 26, 1983, 8:24 PM. 
ieee 12/8/83 Alexandria, Virginia - Alexandria 196A-633 
b6 
This document contains neither recommendations nor conciusions of the FS}. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


ene 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/20/84 


Date of transcription 


a computer programmer, examined 


the flo discs that were seized in the sear bé 
at b7C 
that all discs 
were examined and no information relating to GTE Telemail 
or other telecommunication services were found. 
7 
1/17/84 Alexandria, Va. : Alexandria 196A-633 
investigation on at File # 
, b6 
by Date dictated 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBi and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


vine GO 


FD302 (Rev. 3-10-82). : , e f 
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CNet 3 
ae toy 
fosee : ee 


aha cae iet 
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FEOCERAL BUREAU OF INVESTIGATION 


Cate of transcription Ly 3 l/ 8 4 


a GTE-Telemail, provided a copy of the amount of money b7c 
Os y GTE Telemail from the unauthorized use by the hackers. 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 
[ AHSC $62.29 July, August, 
September 
UAW ; $31.00 September b6 
b7C 
[| Maraven $l6o.00 August, September 
Telenet ' $108.00 July, August 
[sd BMW $0.29 September 
; $127.58 


[ CBOT $2.00 September bé 
b7c 
[ RADA $1.00 September 


$3.00 
[ Maraven $24.00 August 
Telenet $325.00 July bé6 
b7c 
Telenet ; $151.00 August 
svi 7 | | 
er eee 1/25/84 at__Alexandria, Virginia rite eo Alexandria 196A-633 
by SA sfk Date dictated 1/2 2/8 i cee BS 
: b7C 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the F Bi and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 3 
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FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


12/15/83 


Date of transcription 


The following report is a summary of the activity 
off on the GTE Telemail System, This ie 
same information also applies to the activities off b7¢ 


wife, 


used the following user names 

The names 

user names _ in the node b6 
called @ user names and were bic 
illegal user names in the illegal node CBOT. 

under these various user names left messages on the Telemal 

System from approximately August 30, 1983 - October 11, 


1983. 

[_____Jusea the names and - 
[sw ile a user in the illegal node RADA. She b7c 
used the names and while a user in the 
illegal node cailed CBOT. 

| [is known to have access to b6 
Telemail System, using one of the above-mentioned user b7c 


names, at least 91 times from August 30 - October 11, 1983. 


on Telemai 
and 


is known to have access to Telemail b6 
System, using one of the above-mentioned user names, at b7c 
least 133 times from August 30 - October 11, 1983. 


A review of the actual messages themselves shows 
that the names and occur with some frequency 


in messages left on the Telemail System by 
or one of the other user names identifiable with 
and 
On September_12, 1983, at 12:32 eu,[ __] 
leaves a message for[ fon the Telemail System. 
This message states that Rochester Fire and Safety called bé 


and said that the oxygen was ready and the ba’ nce due b7c 
ae 1 cena Rochentar #irovand, sacekyt 
was interviewe y agents of the FBI and he indicated that 


his records showed that on September 12, 1983, the home 


‘eaeusuncnns LIS 217 835 oz Alexandria, Va. cue elexandria 196A-633 
- b6 
by__ SA ga J Date dictated ___11/21/8 3 b7Cc 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


a 845 


AX 196A-633 


i) 


number for contacted to notify them 


that_a_respirator = |mother was be picked b6 
ap. [Jaaia that the telephone number was b7c 


on the bill. 


b6 
b7c 
b7E 


On October 12, 1983, at the time of the search 
of his residence,|_____]furnished a signed statement admitting 
to accessing a “computer program" by calling the local 
Telenet dial-up number, typi the word "mail" and then BS 
entering a cod however, declined to discuss BIC 
the user names or how he got access 


to the Telemail System. An FD~-302 reflecting interview 
| ee October 12, 1983, indicates says 
he got the password for the Telemail account from 


AY 


FEDERAL BUREAU OF INVESTIGATION 


10/19/83 


Oate of transcription 


was interviewed at his 


residence 
He freely and voluntarily 
sgned statement: 


urnished t ollowing 


freely_and voluntarily 


A 
I 
furnish the following information to SA 
| | and 


"I was born[ __ jana have finished college 
in New England. 


"TI have a personal computer that I use 
personally and professionally in my business. I have 
had a personal computer for about a year. 


is the number I use to access GTE 
Tele-net 716-454-1020 which I do often. I then access 
compuservice, dow jones, etc. Radio Shack, computer 
Stores, will tell you how to use GTE TeleSnet. In 
adoition I had accessability to a computer program that 
handled home messages by using tele-net 716-454-1020. 
Furthermore, this program was not created by myself 

or my wife. A message indicatinoe "Mail" would allow 
entrance and code word would be entered. 


"We (my wife and I) would leave messages for 
each toher on the GTE Tele-Net both being at home, it 
was fun. On the advice_of my attorn I this time 
Go not wish to discuss[|~ ~~ Jand{ Jor how I~ 
got access to these accounts. - 

"{T had no idea what I did was a crime and will, 
with my attorney, discuss this with the government in the future. 


1 e t ie i ; 
date ctober , AS Lo Ai? 


“Tae, rags 
{454 -L33~ 63 
| coe. 2 _ 
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b6 
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BU 196A-529 -2- 


Witnesses: 


SA, FBI, 10/12/83, Rochester, NY 
ecial Agent, FBI, 10/12/83, Rochester, NY 
SAA, FBI, 10/12/83, Rochester, NY 


In addition to the signed statement, he 
furnished the following information: 


He is employed at 


He did not know it was a crime to access GTE 
Tele-Net. The telephone number in Rochester for Tele-Net 
is 454-1020. He calls this number from his computer 
system number which is a line in his telephone. He then 
accesses the computer by using the name 
(phonetic) and thereafter uses a password that he gets 
From a friend named who got it from_an 
individual that was hesitant to discuss. 
did mention (phonetic) 


LYE 


be 


-b7c 


b6 
b7Cc 


b6é 
b7C¢ 


BU 196A-529 = 


During the conversation ee 
often telephonically contacted his attorney, 
[} and[___Jassociate[ J e 


b7C 
[indicated that he would be glad to 
cooperate in the future with any investigation and that 
all he wanted was his computer back since he did not 
know he was committing any crime. 


He stated that telephone| sd in 
is a telephone number for an individual bé 
| —-1. is some type of college campus and bic 
information is available from something called a freak 
board and through this number information can be given 
on how to build "biack boxes" to access all kinds of 
sophisticated computer systems. 


[__]gave this as an example of the type of b6 


information he has available and is willing to provide b7C 
the government, through his attorney. 


A Y4 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 2/ 2 vA 8 4 


The following is a summary of the activity of b6 
on GTE telemail. b7c 


used the names 

and b6 
were illegal nicknames in the company b7c 
was his user name in the company, 

was his user name in MMM Company. 


is known to have accessed the telemail b6 
system, using one of the above-mentioned aliases, approximately b7c 
170 times, from approximately August 30, 1983, through 
October 10, 1983. 


was initially a member of the group 


known as Short for , which was oe 
run _b aka, He later became 
of a group known as LINCOM in CBOT. 
b6 
b7C 
b7E 
57 can be matched Be 
g using one of his aliases, PIS 
actually entering the telemail computer. 

On October 12, 1983, at the time of the search we 
of his room,[____———_—_—s stated that he guessed the search bic 
was due to his telemail computer contacts he made from 
his room. 

waoetbiestiaen 1/30/84 at_Alexandria, Virginia Fie Alexandria _ 
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A review of the paper evidence seized during 
the search revealed among other things, hand written instructions 
on how to change passwords on a telemail account, and “user 
names" identical to those used to illegally access telemail. 


pa Oetanee 19914983,(_— another 


subject in this matter, said he got the password for his bs 
telemail account eal Bie 


2S5/ 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 


October 21, 1983 


was_adyvised of the identity of the interviewing agent 


as Special Agent (SA Federal Bureau of Investigation, 
Ithaca, New York. was shown a copy of the search warrant for 
which he read and stated he had no questions. was 


asked if he had any idea what the basis of the search warrant was and 
he stated that he guessed that it would be a LE Telenet and Tele~ 


mail Computer contacts that he hadimadé=from| a enaienes b6 
asked how he had heard_of these computer services and he stated he _ wis 
learned of them from by the nam 
who is also known to him as who resides in 
[stated eer = first became familiar with by way of com- 
uter approximatel ear_ ago. further advised that 
is described as follows: 

Height: 

Weight: 

Race: 

Complexion: 

Date-of-birth: 

Education: b6 

b7Cc 


Home address: 
Home telephone number: | 
College number: 


b6 
" SA ea 10/14/83 bIC 


Date dictated 
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FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription 2 2/84 


nh ollowing is a summary of the activity of 
on GTE telemail: b6 
: b7C 
used the name in a company 
called RADA an in a company called CBOT. 


accessed the telemail system using one 
of these two names, approximately 19 times, from approximately 


b6 

September 3, 1983, to September 29, 1983. — 
initially was a member of[ _ Rapa, then 

was a member of CBOT. 

at 

b6_ 

b7C 

e matched with telemail b7E 


accessing the telemail system. 


October 12, 1983, during the search of bé 
told FBI agents that 


‘ ’ 7 7 b7c 
had been using telemail to communicate with friends 
in Rochester, New York. 
seietnasnaaese 1/30/84 a _Alexandria, Virginia rie »Plexandria 
196A-633 
b6 
b7C 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription OCtober 21, 1983 


was_ advised of the identity of the Interviewing agent 


as Special Agent (SA) Federal Bureau of Investigation, 
Ithaca, New York, at 9:10AM. was furnished a copy of the search 
warrant for which he read and stated that he understood and 
had no questions. was advised that he could observe the search 


if he cared to but because of the small size of the room was advised 
to stay in the doorway so as to not interfere with the search. 


: b6 
stated he understood, was going to make a telephone call, and then b7c 
except that invitation to remain in the doorway to observe the search. 
stated he did not know the basis for the search. He did advise 
that had been using a computer service 
called Telemail to communicate with friends in Rochester, New York. 
[__ijis described as follows: 
Height: 
Weight: 
Race: 
Complexion: 
Date-of~birth: 
Education: ne 
: b7c 
Home address: 
Home telephone number: 
College number: 
b6 
b7c 


by saL_sét eee 10/14/83 


Date dictated 
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also known as b6é 


FRAUD BY WIRE; CONSPIRACY Bs 
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(Aten: ausa[_ BIC 
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NAME OF DEFENDANT: 


[i described as: 


Race 

Sex (2 

Date of Birth LJ. 

Height b6 
Weight bic 


Social Security 
Account Number 
Address 


ow ST 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


2. On October 12, 1983, the premises located at 

was 

searched pursuant to a duly authorized federal search 
warrant and various computer paraphenalia were seized. 


b6 
b7C 


i 

R 
4 
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WITNESSES: 


. ecco | 
TE Telema1 


2. 


3. 


8229 Boone Boulevard bé 
Vienna, Virginia bic 
Can provide details of GTE Telemail operations, 

methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


Eeeeeeieesl = 
pecial Agent Bic 


Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent 


Federal Bureau of Investigation ee 
Oklahoma City 
b6 
. : b7C 
Can provide testimony that[ __]ena 
are the same, as well as 
information about use of the Telemail 


System. 


Full text of interview pages 3 - 6, attached. 


a lof 
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5. 
b6 
b7c 
Can identify as and provide 
information about use of the Telemail. 
Full text of interview page 7, attached. 
6. 
b6 
b7c 


Can identify as and provide 
information about use of Telemail. 


Full text of interview pages 8 - 10, attached. 


bd 
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EVIDENCE: 
1. Summary of 65 messages left on Telemail b b6 
originals in possession of b7c 
GTE Telemail). 


2. Report with attached inventory of items seized 
in search. 


3. Two reports summarizing relevant items found 
in search (originals in possession of FBI Alexandria). 


4, List of charges attributable to aka 
(original in possession of 7 Be 
5. A Panasonic Video Cassette on which identifies Bas 
himself, then says "You misspelled my name, it's 
is wanted by the FBI. No kidding!" (original 


in possession of FBI Alexandria). 


6. Summary of trap and trace information received 


Ab : 
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FEDERAL BUREAU OF INVESTIGATION 


12/15/83 


Date of transcription 


The following is f 1d ft by the 
illeaal user using the name a 


on GTE Telemail. 


The date and time of each message is provided with a 
synopsis of particularly sidnificant messages inclucec. 


1) August 28, 1983, 9:36 poem. (All tires are Lastern 
Davlicht Time) This messade reads as follows: 
-e-l have found a few administrator accounts. 
Please fill me in on how to do the dialecue with 
the reg user, etc. etc. conmands...and any advice, 


any advice you may nave for going as uncetected 
as posSible. Thanks, : 


2 August 26, 1903, 11:31 p.m. 
3) Aucust 29, 1933, 11:06 0o.m, This messace reads, 
"Wello welcome to nm Telenmail! This 


bulietin board service is to be used to communicate 
with other network users. Current members 


If you would like to have new users adced, contact 
the Administrator, by_ sending a 
message to Admin 

4) August 29, 1933, 1 


p.em. This message reacs in 


part, "Please refrain from the 4 f real names 
or obvious tip-offs while usina private 
mail, or any other communications on Telemail. 
Please use general information only. Use_obvious 
information at your own risk. Thank you, 
Administrator. " 


5) August 29, 1983, 11223 p.m. 
G) August 29, 1983, 11:24 p.m. 
7) August 30, 1983, 12:59 a.m. 
8) August 30, 1983, 8:33 a.m. 
9) August 30, 1983, 3:30 a.m. 
10) August 30, 1983, 4:04 a.m. 
11) August 30, 1983, 8:24 a.m. 
12) August 30, 1983, 8:32 a.m. 
13) August 30, 1983, 5:40 p.m. 


b6 
b7Cc 


b6 
b7C 


b6 
b7C 


b6 
b7C 
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b6 
ee es, as eee oer eee 


28) 
29) 


30) 
31) 


32) 
33) 
34) 
35) 
36) 
37) 
38). 


b7C 


August 30, 1983, 5:54 p.m. 

August 30, 1983, 10:57 p.m. 

August 31, 1983, 5:33 a.m. 

August 31, 1983, 5:35 a.m. 

August 31, 1983, 11:14 a.m. 

August 31, 1983, 1:47 a.m. 

August 31, 1983, 5:04 a.m. 

August 31, 1983, 5:14 a.m. 

August 31, 1983, 5:37 a.m. 

August 31, 1983, 5:40 a.m. 

August 31, 1983, 6:08 a.m. 

August 31, 1983, 6:26 a.m. 

August 31, 1983, 6:26 a.m. 

September 1, 1983, 8:31 a.m. This message reads in 
part, "Oh, by the way, a reporter for a newspaper 
is coming here today to interview me on computer 
theft. I'm afraid I'm going to have to disappoint 
him when I tell him_that I really know nothing about 
it. (Ha!) Later,[ |" 

September 1, 1983, 7:25 a.m. 


September 1, 1983, 1:01 p.m. This message reads in b6 
part, "I'm real sorry about screwing you up with b7c 
those accounts under RADA. It's just that according 
to Telemail will make drastic changes 


to the entire system if they realize an infiltration 
of any size of unauth. uSers...especially after the 
god damn media blitz about the 414's.” 


_ September 1, 1983, 1:50 p.m. 


September 1, 1983, 12:56 p.m. In this message, 
states that he has obtained the dial up access 
number for Long Distance Savers, Inc. and has hacked 
out a customers code. He also indicates that he has 
used this code to make illeaal long distance phone 
calls. 


September 1, 1983, 1:25 p.m. 


, 
September 1, 1983, 1:27 p.m. 
September 1, 1983, 6:08 p.m. 
September 1, 1983, 6:12 p.m. 
September 1, 1983, 1:28 p.m. 
September 2, 1983, 9:26 a.m. 


September 1, 1983, 9:03 p.m. This message is to b6é 
[pana reads as follows, a thanks b7c 
for the info. Will try it out next time I get on 


a DEC-10. I'11l dump those hacking programs to you 
here in Telemail if you have a terminal program 


265° 
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Continuation of interview of orf , Page 5 ei 


39) 


40) 


ay 
LO see 
~~ 


City cron ct fa de oe DB OS dm os om ob 
JCV OI Go fo 
op Robe A a eS 


fs Oo tI b+ OO GF 


Nee Ne ee 


b7C¢ 


capable of data capturing and saving to disc. 
Then you just unload it in and save it back out 
again, this time it will be saved in the non-ASCII 


compressed format which loads faster. 


September 3, 1983, 
"Dial, the following Sprint Code is a 


follows, 


business Sprint account. 
in the United States, 


8:13 p.m. 


Later 
‘This message reads as 


As such it will go anywhere 
inclucing Alaska and Hawaii. 


It also may go to Canada, although I haven't tested b6 


it. 


The Code is 54830522. 
calls that you can't make with ordinary Sprint. 


Use this code only for  b7¢ 


I'd 


also suggest that vou first dial a city such as 


Saint Louis or Chicago, 
from there to place your call. 
Oklahoma City. 


then use this Sprint Code 


Please don't use 


Please consult the Sprint Directory 


I sent you to rancomly select a large city to route 


through. Thanks * 
September 4, 1983, 11:31 p.n. 
September 4, 1963, 11:34 p.m. 
September 6, 1963, 7:07 p.m. 
September 7, 1953, 3:42 p.m. 
Sertember &, 1903, 1:14 a.n. 
Sertember ©, 1963, 4:40 a.m 
Certember 9, 1983, 11:06 a.m. 
September 6, 1983,°2:16 p.m. 
Sertember 9, 19383, 2:15 a.r. 
Sentenber 10, 1963, 10:55. s.r. 
Sertember 12, 1963, 1:19 avr 
September 12, 1903, 1:20 a.m. 
September 12, 19¢3, 7:11 a.m. 
Sertember 12, 1903, 12:44 pur. 
Sevtember 13, 1903, 12249 acres 
September 13, 1903, 12:01 pom. 

to all[___ Members. 


is 


thing like that which would be rather obvious. 


"Be careful." 


b6 

b7C 
This messace is fror 

ghe Ssuljocs of “che: Hessace 


The messace is as fcllows: 

"The fcollowinc forwardec notice 1s an examnle of the 
ways that one can easily be cetected if hachina 
Telemail...anc he does not know what he's doina! 

Sc please take heed of the fact illustratec by this 
letter that it is important that you don't do anything 
strange like changing your nare and your cirectory 
file to read somethina like Adam and the Ants or some- 


So 


please unless you know what you are doing don't 
phuck around with Telemail, 


> 


other than the use of 


Lbe 


AX 196A-633 


Continuation of interview of pets ORL do , Page 4 


55) 
56) 
57) 
58) 
59) 
60) 
61) 
62) 
63) 
64) 
65) 


your account to check and send mail _to 


and the 


b6 
b7Cc 


users of Thank you, 


Admin." This is followed by a forwarded 
message from[ aka con- 
cerning how Telemail bills their customers. 


September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 


13, 1983, 12:09 p.m. 
13, 1983, 1:04 p.m. 
13, 1983, 12:49 a.m. 
13, 1983, 2:57.a.m. 
13, 1983, 2:40 p.m. 
13, 1983, 3:59 p.m. 
13, 1983, 8:14 p.m. 
14, 1983, 9:51 a.m. 
14, 1983, 1:39 p.m. 
14, 1983, 5:53 p.m. 
20, 1983, 6:15 p.m. 


b7C 
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267 


FO-302 (REV. 3-8-77) & & 


FEDERAL BUREAU OF INVESTIGATION 


lL Date of transcription Decemher 7, 1 983 


The authority of a search warrant issued in the Western 


District of Oklahoma by United States Magistrate Ronald L. Howland, 
a search of a residence known as bé 
was conducted. Attached is a copy of the receipt and inventory 


of the items seized pursuant to the search py of the ie 
receipt and inventory was furnished ee who was 

present during part of the search and was present at the conclusion 

of the search, This inventory was made in the presence off 


and his son, 


(Gin- 285 
“Oklahoma City 


lnvestigation on__LO/1L2/83 at rite ¢ L96A-1270 


b7C 
LO7 12783 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12/ 7/ 83 


The following is a review of evidence seized pursuant 


to a duly authorized Federal Se he 
premises known as b6 
This is the residence o b7C 


The following is a summary of evidence relevant to 
this investigation: 


1) A white 3 x 5 card with numerous user names and 
passwords. The computer system is unknown. 


2) An 8 x 10 printed pamphlet with the title, "Free 
Long Distance" with numerous references to MCI 
codes and Sprint codes. 


3) A mailing envelope addressed t b6 
| = b7Cc 


b6 


5) Envelope with numerous addresses on mailing labels, 
noludi 


b6 
b7C¢ 


6) A printout on silver paper with numerous listings 
including, "Introduction to Telenet," Blue Box 
Operation, and containing numerous Sprint access 
numbers. 


7) Paper with instructions on computer systems known 
as, "DEC 10, and DEC 20, containing instructions 
about access in the system and passwords. 


8) A long printout containing numerous first names, 
followed by, "Interests." 


9) A printout that refers to a prime computer. 


investigation on__LI/10/83 at Alexandria, Virginia rile +Aleyandria 196A-633 


b6 
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10) A scrap of paper with numerous names and phone 
numbers, not identical to any known subjects. 


11) A printout of "Bulletin Boards in North America” 
including, Telenet numbers and Telenet System 
Commands. 


12) reen envelope addressed to 


A 


b6 
b7Cc 


This envelope contains a handwritten note, 
called. He says its better to send 
the tapes by USPS rather than UPS." 


13) Two copies of a "Revised Telenet Phone Number 
Guide." 


14) A two page photo copy of "Revised Tymnet Phone 
Numbers.” 


15) Four copies of "Uninet Network Access Phone Numbers." 


16) Two copies of a letter | from 
the office of Legal Counsel, University of Oklahoma, 


dated September 30, 1982. This letter is in reference p6 
to the termination of the lease at b7¢c 
The letter mentions in part, "You have willingly 

and knowingly allowed your son,[____t to operate 

a computer business from this premise.” 


17) A printout entitled, "All About User-Publishing." 


18) Two —— of a printout entitled, { b6 


Mailing List." pyc 
19) One copy of "Sprint Access Numbers." 
20) A printout with various names and user identification 


numbers, none of which are identical to known 
subjects in this matter. 


21) A typewritten _paper titled, "Macrohost Commands- 
jis| L* 
b6 


b7C 
22) Mailing envelope addressed a containing 
a floppy disk labeled, "All ST80 Modules, plus 
Non Com/ctl." 
23) Printout titled, "Connected to the Source" with bé 
a message on that printout from p7c 


—oLy” 
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24) 


25) 


26) 


27) 


28) 


29) 


30) 


31) 


32) 


34) 


35) 


36) 


37) 


A computer printout with a message from[_____—i 
on it. 


A printout indicating_a_ connection to the source, 
with a message from ; et 
A printout again showing a connection to the source. 


A forty-seven page copy of a pamphlet, indicating 
various ways to cheat the phone company. 


A typewritten paper called, "Scanning for Codes 

on the Northern Telecom Switching System" by 
This paper describes how to obtain 

Sprint codes. 

A typewritten brochure on, "Picking Ward Locks." 


A typewritten brochure on, "Picking Other Types 
of Locks." 


A typewritten brochure on, "Phone Operations." 


A printout that is a letter from 
soliciting a computer bulletin board ad. On this 


printout, he gives his home phone number and address. 


A printout with a message el 
containing codes for extending numbers. 


An 8 x 10 sheet of paper with various 800 numbers 
written on it. 


A printout with source accounts and passwords. 
This printout also contains a message from 

and In this message, referrs 
to his "real identity" and to the fact that he 
believes "law enforcement" is watching him. 


A handwritten questionaire about bulletin boards, 
including the question, "Would you participate 
in a secure, private, freak bulletin board on 
the source?" 


A piece of cardboard containing a mailing label 
indicating the object was mailed trom] __——S—~d 
to was a subject 

of a search in in this matter. 


Peat 


73 
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38) 


39) 


40) 


41) 


42) 


43) 


44) 


45) 


46) 


A Sprint bill addressed tol id and 
dated December, 1982, in the amount of $572.00. 


A printout with numerous names and identification 
numbers on them, none identical with subjects 
in this case. 


A typewritten paper mentioning "USEMC-BBS." 


A printout of a message from[ st asking 
for information on how to hack a prime terminal. 


A "Temporary Users Guide to the United States 
Electronic Mail Center” dated August, 1983. 


A printout with a message from about 
accessing the computer at the University of Kentucky. 


A_printout with a message from - 


to accessing a computer at Boystown. 


A printout from[ sd referencing a Telemail 
Account. 


47) A paper with the name 


48) 
49) 


50) 


51) 


52) 


A printout with various MCI access codes listed. 


A handwritten letter from[ tg aka[ 


Newspaper article with picture eel 
Included in the text is the quote, as follows 


"Modem users are required by Federal law to register 
their modems." 


Letter from to the Office of Legal 
Counsel, University of Oklahoma, Norman, Oklahoma. 


“Pete 
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b7c 


b6 
b7Cc 


b6 
b7C 


b6 
b7c 


be 
b7Cc 


b6 
b7c 


b6 
b7C 


b6é 
b7Cc 
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53) 


54) 


55) 


56) 


57) 


58) 


59) 


——~' 60) 


61) 


A letter from tof 
in reference to legal action against the phone 


company in reference to Modem charges. 


Printout of message on "Compuserve" from 
7 a _ return address of 


Printout of program to a bulletin board established 
oC (poaaeoreneer | called "USEMC of Norman, Oklahoma." 


A printout of messages from the Osuny Bulletin 
Board. In this maseages(  sleaine about 
Chicago. 


A printout with messages about MCI access codes, 
source accounts, etc. 


Is a printout containing a message from 
Within the message is the statement, "A remailing 
service is now available exclusively for members. 
If you need to leave your address for illicit 
urposes, you may leave a Post Office Box in 

and your mail will be forwarded to you 
first class for the cost of postage, plus fifty 


percent." It continues "If you are interested 
peice] 


A printout with a list of names, each name preceded 
with the words, User ID: and then the numbers 
i,l. These numbers continue down to user ID: 


1,93. The name 
andl << | appeannea-enae clase: 


A computer printout beginning, "Dear Fellow Modem 
User, and continuing with the statement that if 

a person wants additional information on how to 
avoid paying the extra charge-for a modem, the 
can write to the address 
and the number is (which appears to 

be a compuserve account. ddress also 

one number Voice; 
Paes These_telephone ubers 
the add 


are followed b 


A copy of a page out of a book titled, "Revised 
Telenet Phone Numbers." 


B13. 
ATS 


b6 
b7c 


b6 
b7C 


be6e 
b7C 


b6 
b7C 


b6 
b7c 


b6 
b7c 


b6 
b7c 
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62) A printout_containing a_message from the Telemail 
Account of[_[tol__} The text of 


63) 


64) 


67) 


68) 


69) 


this message says "I can only get the quick reference 
booklets at this point. They are about ten pages 
each. I can xerox important admin_functi also." 
The message continues "telephone 
Name: 53552, Password: 426," and then the message 
continues, "and leave address there. OK? Take 
it easy, signed " This sheet of paper 
also has handwritten no ining the name, 

and t also 
has the name, number 

and the number 


Four pages of typewritten material, beginning 

with the words, "The Electronic Mail System." 

The fourth page of this document is titled, "Calling 
Through Sprint" and suggests that if you have 

called the Osuny Bulletin Board, that “Your number 
is probably being traced." This article also 

states that this bulletin board is_in fact 

which was the illegal account that had 
created on Telemail. 


A typewritten page with one paragraph entitled, 
"To Get A Pree Telset From Bell." This paragraph 
gives you details about how to obtain a person's 
actual number of extensions in his home and then 
call the local phone store pretending to be that 
person, and arranging to get an extension that 
the innocent person will be charged for. 


A printed sheet of paper titled, "Maxhost/Cmd 
py 

A computer printout beginning with _t words 
The USEMC V. 6.0, copyright 1983, 


A copy of two pages labeled, “Local Telephone 
Numbers for Access to the Sprint Network." 


A sheet of paper with numerous telephone numbers 
in Los Angeles, San Diego, Boston, St. Louis, 
North Carolina, Hawaii, and Texas, written on 
it. 


A computer printout with numerous messages referring 
to obtaining Sprint codes. 


retire 


276 


b6 
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b6 
b7c 


b6 
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70) A computer printout containing the message number 
8: titled, "To Find Telenet, Dial your local 
Access Number, then at the @ sign, type in MAIL. 


71) A_ computer printout with the handwri b6é 
followed by the address, b7c 


72) A series of pages titled, "The United States Electronic 
Mail Center ~ Version 6.0 Users Manual, Summer 


of 1983." This typewritten page contains the ae 
words, "The USEMC~DBS~-300Boud ie 
[. Copyright 1983, by 


73) A computer printout containing the names of numerous 
administrators for Telemail Accounts. Handwritten 
above these names are the words, "Checked September 12-13, 
1983. 


74) A computer printout with numerous user names followed 


by the words, “User ID: and a_number, followed 

b6 
by a second number. The names and nae 
[jas well as appear in 


these names. 


75) A computer printout fr e Telemail System. 
The message is fron[ Jeo] The message 
states to go undetected in the system, use a b6 
regular user name, such =e amen other names b7C 
that are common. The message continues and lists 
commands that administrators of accounts can use. 


76) A computer printout with two messages. The first 
message says, "Here are the dial up to the NIH 
computers!" It then lists the dial up numbers 
for three National Institutes of Health computers. 

A second message is from Jupiter FBN. The message 
says, "Here is an Arpanet access number, 800/638-4870. 
It is a TAC computer (Military Network). Don't 

abuse it because I desperately need that Watts 

line for communication." 


77) A computer printout listing a number of host systems 
on Telenet. Following the listing of about twenty 


companies, is the statement, "I thought I would me 


post these because they might be interesting because — 
they are Ipcated in Canada, signea( = 
circle. 


Followed by the words, "The inner 


cee IGF 
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78) 


79) 


80) 


81) 


82) 


83) 


84) 


85) 


86) 


87) 


Two typewritten pages titled, “The Telephone Connection 


Premiere Issue, February, 1983." The article 
discusses among other things, Security 
on Compuserve, and Telephone Tracing, and Sprint. 


A computer printout with the words, “Dial up - 
(202)695-0441, followed by the word, password 

- DARCOM. Followed by the words, "Por an outside 
line, simply say, outside line, you must first 
specify "Routine Traffic." These are instructions 
for someone to illegally access the military's 
autovon system. 


Two pictures of a computer setup, taken in December 


of 1982. This appears to be the computer setup 
of | 


A computer printout with numerous listings as 
follows: "MCI found at: and access code and 

the local MCI dial up.” Also found on this computer 
printout, is the telephone and 

the word, 


A copy of a sheet of paper, titled "Uninet Network 
Access Phone Numbers by States." This sheet of 
paper bears the initials, 


A_letter addressed tol sd Exom 

Counsel for the source. The letter states, 
"As we discussed, enclosed is a STC subscriber 
agreement.” The letter then continues, "I look 
forward to hearing from you on the source regarding 
the Oklahoma modem charge.” 


A three page typewritten letter beginnin "Thank 
you for your interest in the usemc-pBs{ 
and signed by 


A typewritten pamphlet entitled, "The United States 
Electronic Mail Center, Revision 6.0, Temporary 
Users Guide, September, 1983." 


A computer printout containing what appear to 
be the names of the administrators of various 
Telenet/Telemail Account holders. 


A Long computer printout referring to requests 
> a other bulletin board users to 
give him stolen Sprint account codes, because 


he is on his last one. 


rE Le& 


AIF 


b6 
b7C¢ 


b6 
b7C 


b6 
b7c 


b6 
b7c 


b6 
b7c 


b6 
b7C 
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88) 


89) 


90) 


91) 


92) 


93) 


94) 


95) 


95) 


96) 


Audi assette with the word hone and the number 
On this tape, is talking 

to another person on the phone. They make up 

a fictitious name bad heakea a collect phone 

call to that name to see if the call can actually 

be made. The call is to a place called Death 

Valley Junction, and the phone number is 2. 


A_co of a Sprint Travel Card bearing the name 
aaa and nuterous Sprint access 
codes and Metro phone access codes written on 
it. 

A white card bearing numerous Sprint codes and 
the “date found" and the initials of people that 


he gave the Sprint codes to. 


A white sheet of paper bearing numerous Sprint 
codes. 


A_sheet of = bearing the words,| sd b6é 


Part of a Southwestern Bell phone bill, dated 


August 21, 1983, for phone nunber [a 
It contains a bill for a call ton er (914)725-4060, 


which is the Osuny Bulletin Board. 


A subscriber form for long distance savers, with 
the salesperson's name listed as 
The subscriber's name is 


A sheet of paper bearing the name 
‘WO 


telephone numbers are next to the name, as follows: 
eS P| | 


A typed sheet of paper, "Prepared a 
which lists instructions for creating a red box, 
which appears to allow you to fake the sound of 
coins dropping into a coin phone. 


A computer printout with a list of the followin 
names: 
This sheet of paper 
orm, the ae meme Pee 
the number Next to this, is written 


is also written on the paper. 


also 
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97) 


10 


A computer printout with the names 


98) A computer printout of one hundred and ninety-three 
names, beginning with the io) aeenaaers Pee 


99) 


100) 


101) 


102) 


103) 


104) 


105) 


106) 


the password, Video. 


A_computer printout bearing the handwritten words, 
andl 
A white piece of heavy paper, bearing approximately 


twenty names and passwords. The third name down 
tel led pacewona: azpaned: 


A telephone bill for telephone number 


dated July 21, 1983. The following numbers are 
frequently called: 


A computer printout from 
says he would be a "willing student," referring 


to the use of MCI, Sprint, Compuserve, and the 
Source. jaives his address ae] | 


A computer prj with a_message from a Telemail 
account, from ? eal This message 


discusses an 800 number used to access Arpanet. 


A computer printout listing the users of GTE. 
This list also has handwritten next to the user's 
name, what appear to be passwords. 


A telemail message, dated Thursday, September 1, 
1983, from :S ae The message 
concerns how to use a computer system known as 
DEC-10. 


A white sheet of paper with handwritten notes 

on it. The notes show the name and the 

word Neal, next to the word Neal was 
password on Telemail. These notes also 


include the name[ sd and the term BIZCOMP. 


These are both user names and an account name 
that were used on Telemail. This sheet of paper 
also bears the name and the address 


was one of the frequent illegal 
users of Telemail. 


Fate 


LED 
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ll 


‘7? —" 107) A computer printout bearing one hundred and forty-three 


names and home phone numbers of various computer 
hackers. 


108) A pink sheet of paper with the Ohio Scientific 
Users Group, and the number on 
it. This sheet of paper also contains words, b6 
"Death Valley Junction, California." It also b7C 


contains the ro numbers[_——_—iand 


109) A white sheet of paper bearing the name 


Underneath that is the word 
number[___ sand 


sheet of a also bears the address, 


110) A sheet of note paper bearin 


b6 
and telephone oo b7C 


111) A sheet of paper bearing the term, "The United 


112) 


113) 


114) 


115) 


116) 


117) 


States Electronic Mail Center, Auqust, 1983. 
It also bears the name bé 
and a name b7c 


A typewritten booklet starting with the words, 
"This is the book on cheating the phone company." 


A typewritten booklet that begins with the words, 
"This is the paper on picking lever locks.” 


A typewritten booklet that begins with the words, 
"This is the book on padlocks." 


A computer printout with one_of the messages being 
cof | from | content = BS 
of the message is, "Last night I logged into Telemail oie 


and logged out to log in as another user. P.S. 
I was using the 800 number." 


A computer printout beginning with the words, 
"Codebreaker for the_Hayes Smartmodem. The second bé 
line bears the nameL_ o 


A computer printout with a message from 


to 


The message states Be 
that the main_reason is writing bie 
is so that[___can look at this Telenet address: 

301162. 


Bake 


2x! 
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118) A blue homemade box containing a touchtone keyboard 
with wires exiting from the box. 


IFSP. 


FD-302 (Rev. 3-10-82) ( +! b6 
be lw all b7C 


FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 


Date of transcription 


A review of the evidence seized pursuant to 
a Federal search warrant executed at b6 
|-—-saveater thet the residence 6 bIC 


revealed the following items of interest: 


1.) A san/bar 400 F "relay circuit" that is 
labelled "property of the Bell System". 


2.) Two 400D KTU "relay board" also labelled 
"property of the Bell System" 


3.) A circuit board labelled 400 H KTU, also 
labelled "property of the Bell System* 


1/10/84 Alexandria, Va. Alexandria 196A-633 
Investigation on at File # 
‘ b6 
aL——s*d a V/ll/ad bs 
by Date dictated c 
This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


L 


Date of transcription 


CF crarmmeae sal ,2,rommuter programmer, exanived 


1/16/84 


the computer uipment sei e_ search of b6 
the residence b7C 
found that the "disk interface" had 
arrived in a *non~-operative® condition. stated bé6é 
that the disk interface had been modified and that without b7Cc 
that particular interface or one that had been similarly 
modified, none of the disks could be interpreted. 
1/10/84 Alexandria, Va. Alexandria 196A-633 
Investigation on at File # 
b6 
salsa 1/11/84 
by g J Date dictated / / b7C 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


Ba2e n¥y 


i.g02 (Kev. 3-1-ad! Be 


FEOERAL BUREAU OF INVESTIGATION 
Oates ivedterotion 7.31/84 


On January 24, 1984, 
ai, GTE-Telemail, provided a copy of the amount of money b6 
lost by GTE Telemail from the unauthorized use by the hackers. b7c 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
For each company}: 


UGE COMPANY AMOUNT MONTHS 
[| HSC $62.29 July, August, 
Septemper 
UAW $31.00 September 
[| Maraven $16.00 August, September ae 
See ene res tae ere aes 21s (a! 
Telenet $108.00 July, August 
[| BM $0.29 September 
$127.58 


. . . . . . . . . . . . ° . . . - 


[| CBOT $2.00 September 
b6 


[el RADA $1.00 September Rat 
$3.00 
[| Maraven $24.00 August 
Telenet $325.00 July b6 
b7c 
Telenet $151.00 August 
jaaeraseeaee 1/25/84 a Alexandria, Virginia ries Blexandria 196A-633 
by SA bSfk Gateaduted wl / 25/88" 2 Be 


b7¢ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 
2/15/84 
Date of transcription 
subpoena at 4 b3 
b6 
b7c 
Further, GTE Telemail records show[ b6 
accessing the telemail system at 12:31 a.m. Eastern b7c 
Daylight Time through telenet dial-in number 405-232-4546. 
sca ey 
trap and trace computer intouts and a hand-wr en b7E 
explanation provided byL are attached 
to and incorporated within this report. 
2/2/84 Alexandria, Virginia Alexandria 196A-633 
Investigation on NI ee Fil Po SD 
b6 
sil_—S—=*i tre 2/2/84 ere 
ie se = Date’ dictated cine 
This document contains neither ;ecommendations nor conclusions of the FBI. It is the property of the FBI and is Joanéd to your agency: 


it and its contents are not io be distributeo outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


x Date of transcription 2/15/84 
lowi summary of the activities 
of aka on GTE b6 
‘Telemail. bic 
used the altas[____} bé 
AND[__———sddon’ GTE Telemail. : b7C 
was the son responsi creating 
an illegal "node" called (short for ) 6 


in RADA COMPANY. This illegal group has 26 different user b7c 
names registered. Each of these users was therefore 
able to illegally access the telemail system. 


later created an illegal "node" call 


[_csor in the company CBOT. This node bee five oe 


jllegal users registered Finally, created 
an illegal "node" called MM in the MMM COMPANY. Pre 
This illegal "node" had five illegal users registered 
in it. 

is known to have accessed the telemail b6 
system in excess of 65 times between August 28, 1983, b7c 


and September 20, 1983. 


“Trap and trace records of 


b7E 
b6 
b7C 
Further, GTE records show 
system during that same time frame. 
eda 2/2/84 Alexandria, Virginia Alexandria 196A-633 
nvestigation on me File # DY 
SA 2/2/84 Be 
by : URE Date dictated __ / / b7c 


ts document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: 
it and its contents are not to be distributed outside your agency. 


94, 


FD-302 (REV. 3-8-77) 


pa 


< b6 
AC? Les b7C 
‘ys Le ‘FEDERAL BUREAU OF INVESTIGATION 
i i Date of transcriptionDe Cembe rv, 1 9 83 


At 8:15 a.m., agents of the FBI knocked on the front door 
re | In their possession at the time was a searcn warrant b7c 


issued in the Western District of Oklahoma by the United States 
Magistrate, Ronald L. Howland for this address. 


Agents knocked on the door, which was opened by an individual 
who identified himself Uae eee ee ere ae advised b6 
of the identity of the agents and the fact that they had a search b7c 
warrant for the premises. 


Upon entering the apartment, the agents determined that 


was and that he lived in the apartment 
with his father, requested permission b6 
to contact his father_by telephone which was granted and Special b7c 
Agent advised ever the telephone of the circumstances 
of their presence in his apartment. indicated that he 


would return to the residence upon the completion of the class he 
was due to teach. 


ee given_a_ form titled “Interrogation; 
Advice of Rights” which he read.[ stated that he would 


decline to_sign this form or anything else upon the advice of an b6 
stated that who was an attorney b7Cc 


and contacted this person by telephone. [———sdtheen 
the agents Cs aaa (oer advised him not to talk to the 


agents present. 


ie City 
Investigation On 10 ia 2 / 8 3 19 “h27 0 


File # 


by 


Date disatedig LO 71D 78 3 os 
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FEDERAL BUREAU OF INVESTIGATION 


PROSECUTIVE REPORT OF INVESTIGATION CONCERNING 


3 also known as b6 
b7C 
FRAUD BY WIRE; CONSPIRACY 


Copy to: 1 - USA, Alexandria, Va. 


b6 
(atta: ausa[ —_} 


b7c 


FBI/DOU 
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NAME OF DEFENDANT: 


[i described as: 


Race 


Sex s 
| | ( 
c . : V 


Social Security 
Account Number 

Height 

Weight 

Hair 

Address 


b6 
b7C 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts of this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in this matter. 


2. On October 12, 1983, the premises located at b6 
was searched pursuant b7c 
to a duly authorized federal search warrant and various 
computer paraphenalia were seized. 
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WITNESSES: 


7 | ss 
GTE Telemail b6 
8229 Boone Boulevard b7C 


Vienna, Virginia 
Telephone [~—_] 
Can provide details of GTE Telemail operations, 


methods of detecting unauthorized users and 
procedures for obtaining print-outs of customer 


messages. 
2. —- 
Special Agent 
Federal Bureau of Investigation 
Can supply details of investigation. 
2 
special Agent bé 
Federal Bureau of Investigation, Detroit — 
Can supply details concerning search off 
and details 
concerning use of a pen register on the home 
phone of Stajda. 
4. 
b6 
b7C 


Can supply details confirming thatL___ iis 
concerning admissions made py[- to him. 


3/0 
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EVIDENCE: 

Note - Originals of pen register information, 
as well _ as court order authorizing same are in possession 
of saf ss «FBI Detroit. 

1. Copy of search warrant and attached affidavit. 
2. List of 20 messages left on Telemail b 
(originals are in possession of 
GTE Telemail). 


3. List of relevant items obtained in search (in 
possession of FBI Alexandria). 


4. List ie to[ (original 
he 


in possession of 


5. Report with information on authorization of 
pen register. ; 


3/1 
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b6 
b7c 


Oven (@rivavit FOR SEARCH wARR( @® 


DISTRICT 
United States District Court Eastern District of Michigan 
7 ~ Southern Division 


: ; DOCKET NO. MAGISTRATE’'S CASE NO. 


Ves NAME AND ADORESS OF JUDGE! OR FEDERAL MAGISTRATE 
The premises known as 
Barbara K. Hackett b6 
Detroit, Michigan 48226 


The undersigned being duly sworn daposes and says: That he/she has reason to believe that 


DISTRICT 
CO on the person of on the premises known as : . : : 
in 1 1 d 


described 


computers and computer associated devices such as modem, CRT 

terminals and keyboards, printers, disc drives, tape drives and 
other input/output medium; magnetic media including but not 
limited to magnetic tapes, discs (hard or floppy); all output 
produced by or caused to be produced by a computer including 
printer output, teletype output or paper tape output; ail notes 

Affiant alieges the follow: ounds, for'sea and seizure 2 : (SEE ATTACHED 


& See attached affidavit which 1s incorporated as part of this affidavit for search warrant 
Affiant states the following facts establishing the foregoing grounds for issuance of a Search Warrant 


Sos Ce gl 


SEE ATTACHED ion as - 


ni e 


~ 


SIGNATURE OF AFFIANT OFFICIAL TITLE, IF ANY 


orn to before me, and suibscribed-in:pry presence: 
OATE 


Special Agent, F.B.I. b7C 


JUDGE OR FEDERAL MAGISTRATE 


October 11, 1983 Barbara K. Hackett 


Junited States Judge or Judge of a State Court of Record. 
211 9 search is to be authorized “at any time in the day or night’ pursuant to Federal Rules of Criminal Procedure 41 (c), show ressonsbie cause therefor. 


Baa 3B/A 


4/3 


@ @ 
AFFIDAVIT IN SUPPORT OF SEARCH WARRAY 


The undersigned being duly sworn deposes and say: 


I 

Affiant,[ tg is a Special Agent with the ao 
Federal Bureau of Investigation and has been so employed for 
four years. Affiant is assigned to investigate allegations 
of violations ae Peder a1 criminal laws suede 18 U.S.C. 
61341 (mail fraud), 81343 (wire fraud), 81362 (wilful interference 
with means of communications controlled by the United States, 
and 6371 (conspiracy to commit fraud by wire). Affiant has 
received a certificate after completion of a month long course 
in computer related fraud at the FBI Training Academy. For 


ne year affiant has been assigned to monitor 


"iy 
ry 
Oo 
Ps 
od 
S| 
fy 
rt 
i) 
tt 

he 
oO 


ap 
computer bulletin boards. A computer bulletin board as referred 
to in this affidavit is nothing more than a small capacity com- 
puting device (including CRT terminals and keyboards), such that 
are commonly available on the retail market, a modem, or a device 
that allows data communication to be sent over a telephone line, 
and some kind of data storage device connected to the computer 
(including magnetic tapes and/or hard or floppy discs). Fre- 
quently, the operator of a "bulletin board" will have a small 
CRT screen and a printer as well. 

A bulletin board program as referred to in this affidavit, 
is merely a set of data instructions to a computer, either pre- 
purchased or devised by the user, which allow the collection of 


devises described to function as a “computer bulletin board." 


ae 


= 
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eo | e@ 


The "computer bulletin board" functions as a medium of informa- 
tion exchange for other persons who likewise own computers. To 
use a "computer bulletin board", a person dials the associated 
telephone number of the board to be contacted and waits until a 
data tone is heard. Then the call is electronically or acousti- 
cally coupled to the caller's computer. Now, the caller may 
peruse information files, leave messages, or even "converse" by 
keyboard with the person at the opposite station. 

The vast majority of dial-up computer bulletin boards are 
legitimate in nature, and serve the needs of the avid computer 
hobbyist or conversant. Some serve as forums or meeting places 
for various sexual activity or esoteric thought 6e inclination. 
Others, referred to as "hostile" bulletin boards, offer a medium 
of Svannge for illicit, criminal and £ 
_at Telecommunications Common Carriers and operators of large 
nationwide computing services. 

While one may set up a computer bulletin board with inexpen- 
sive equipment and a modicum of computing knowledge, many have 
reached the sophistication of more advanced systems by requiring 
passwords in order to access data and leave messages. 

Through his training and experience, your affiant is aware 
that computer bulleting boards have varying degrees of security, 
which is to say, some subject matter may be accessible to the 
casual caller while the operator of the computer may allow only 
certain callers with "passwords" or "codes" to peruse and leave 
more sensitive and illicit data and information. The operator 


of a hostile computer bulletin board may demand some illegal or 
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illicit information from the caller as a sign of good faith 


before access is granted to the more sensitive data files. 
II 


Affiant has learned from officers and employees of GTE 
Telenet Communications Corp. (GTE) at operations headquarters 
in Vienna, Virginia, through conversations with special agents 
of the Federal Bureau of Investigation that GTE owns and operates 
a computer network known as Telenet which links various sub- 
scriber companies and government agencies, through a tie-in 
system, in numerous cities. GTE is a Telephonic Common Carrier, 
regulated by the U.S. Government, which operates as follows: 
First the user dials a local and usually toll-free access number. 
A tone, analogous to dial tone, is returned to the caller. Next, 
the caller dials in an access code provided by the common carrier. 
Finally, the caller dials in the telephone number to be called. 
Computerized billing equipment owned by the common carrier auto- 
matically times the call and bills it to the person whose access 
code was used. The use of a Common Carrier Access Code is similar 
to the use of a telephone company credit card. Common carriers 
cannot at this time determine the origination point of calls 
placed through their facilities, only the destination points. 
Common carriers, therefore, are only aware of fraudulent and 
illegal use of access codes after the legitimate customer informs 
them after the legitimate customer receives a bill by mail. 

Recently (since mid-August of 1983) it has. come to the atten- 
tion of GTE that computers of certain Telemail subscribers have 


been accessed by a group of intruders. The intruders, some of 
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whom appear to have banded together in groups known as “Inner 
Circle", “Operation Circle" and "Phalsers" have gained access 
to certain subscriber administrators and established pirate 
"bulletin boards" within the subscriber system, as well as 
browsed through subscriber files. These "builetin boards" 
have been established without the subscriber's guowieded or 
consent. 

Once it was determined that certain Telemail customer 
files were being infilitrated, GTE was able to retrieve 
messages posted on the pirate bulletin boards and determine 
that traffic between "Inner Circle" members discussed on 
August 15, 1983, an operation known as "Ultimate Rip-off". 

In one of the messages on the bulletin board on August 15, 
1983, a subject calling himself[ noted to a subject 


calling himself[ that he[ sd picked the 
b6 


wrong system because code 21256 is a demo system and "you can't b7c 
really do anything with it". [fadviseaf dhe 

was supposed to get into system C-21267. FBI investigation has 
revealed that both account number 21256 and 21267 are Telemail 
accounts assigned to Citibank, New York, N.Y. Another message 

on August 15, 1983, asks the question "Who is going into the 

banks and pick up the money." 

On late afternoon August 25, 1983, GTE advised the FBI at 
Alexandria, Virginia, that a further review of their system 
has uncovered other intruders not previously discernible to 
GTE which indicates that this intrusion problem is far more 
widespread than previously thought. GTE has been able to 

oe 
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retrieve a number of pirate messages ahien reflect the intruders 
sharing information giving directions for access to other 
systems as well as the GTE system. 

Recently, it has come to the attention of GTE that the 
accounts of approximately eighteen Telemail subscribers have 
been accessed by unauthorized intruders from different areas 
of the country. The intruders have gained access to certain 
customers’ Telemail subscribers accounts by determining pass- 
words assigned to Telemail subscribers through a process called 
"hacking". In this process, a "hacker" chooses a subscriber 


account such as Raytheon, NASA, USDA, RADA Corporation, Coca 


Cola USA, 3M Corcoration. The "hacker" then begins to try 
numerous successive passwords (e.g., each letter of the alphabet, 
or the administrator's first name, etc.) until the correct pass- 


word is discovered. Many hackers program their home computer to 
systematically try passwords for hours at a time. Once a hacker 
has broken a terminal's password, he can now enter the Telemail 
system as if he or she were the legitimate subscriber. The 
hacker would do this by calling any published Telenet dial in 
number and then placing his or her telephone on a modem hookup. 
This modem hookup now allows the hacker to type on his or her 
home computer keyboard and have the impulses sent through the 
telephone system into the Telenet computer system. The hacker 
then types in the command "Mail" and enters the Telemail mailing 
system. At this point the computer prompts the hacker with "User 
Name?". He or she then types in the words (for example) ADMIN/ 


NASA. The computer then prompts with "Password?" and the hacker 
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then types in the password that he or she has discovered through 
hacking. At this point the hacker is accepted by the system as 

a legitimate subscriber, and may perform many of the functions 
that the subscriber can perform, all of which would be charged 

to the legitimate subscriber. At this point the hackers create 

a pirate subdivision in the legitimate subscriber organization, 
such as ADMIN/inner circle/NASA and then set up user names in 

that new "pirate" account. User names may be any compilation 

of letters and numbers but are usually a first initial, period, 
then last name (Gvexgte a The hacker, as administrator a 
of his or her own subdivision, now sets up passwords for all 

his or her users, notifies them of their user name and password 
and they can now enter Telemail with their names and passwords. 
These users may then leave messages on the system to an individual 
in the group, to the pirate administrator or (because the computer 
believes they are legitimate) to any other user (legitimate or 


illegitimate) in the entire Telemail system. 


Iit 


Affiant has learned from FBI s/A[ stat on 


approximately August 23, 1983 GTE Telemail discovered the 
unauthorized usage of customer accounts of American Hospital 

b6 
Services Corporation (AHSC) and Raytheon Company by a person(s) bic 


This person(s) was (were) using Telenet Dial inf 
and[ sid This person has entered the accounts of 


Telemail customers without authorization in excess of sixty (60) 


times from August 23, 1983 to September 24, 1983. 


oo © 


IV 


Affiant has learned from Michigan Bell Telephone Company 


records that the phone numbers[ ——sidarnc€ fs 
b6 


[st which affiant has discovered is a two story, white b7C 
frame house located on[_ 


Vv 


On September 24, 1983 a confidential source, who has pro- 
vided reliable information in the past, which information has 


: of ‘ . ; b6 
been confirmed by Special agent[ FBI, and who on — 


one cccasicn gave information which lead to an arrest, told 


[othe source identitied[ 


Po Subsequently, the source was ie 


vi 


b7C 
that Raytheon Company's account on Telemail was in fact terminated 


by an unauthorized user on August 29, 1983. This information was 
not released to anyone outside the Raytheon Company or GTE Tele- 


mail. 
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VII 


On the basis of a court order signed by United States 
District Judge Avern Cohn, Eastern District of Michigan, 
Southern Division, a pen register, a device which records 
the number dialed from a particular telephone was placed on 
ee 
b7E 
VIII 


On October 11, 1983 your affiant confirmed that from 
August 23, 1983 to October 6, 1983, Telenet account numbers 
313/964-2813 or 313/964-5538 were called at least sixty (60) 
b6 
IX 


Due to the continuing nature of the offense, that is the 
devising of a scheme or artifice to defraud GTE, AHSC and 
Raytheon Corporation through the use of computers and computer 
related equipment over a telephone at a given location your 


affiant believes that the fruits and instrumentalities of said 


‘ b6 
crime will be found at{ IC 


XI 


Based on all of the above facts, your affiant submits that 


there is evidence of an ongoing offense located at the premises 
b6 


in the Eastern District of Michigan. At that location are 


eo. ce 

computers and computer related paraphernalia records, docu- 
ments, papers, and notes which are the fruits, evidence and 
instrumentalities of an offense against the United States, 

that is wire fraud in violation of Title 18, United States Code, 
Section 1343, mail fraud in violation of Title 18, United States 
Code, Section 1341 and conspiracy to commit wire fraud and/or 
mail fraud in violaticn of Title 18, United States Code, Section 


371. 


TT ——  b6 
Special Agent bic 


Federal Bureau of Investigation 


SWORN TO before me and 
SUBSCRIBED in my presence 


this llth day of October, 1983, 


~~ 


UNITED STATES MAGISTRATE 


3P-D 


— 


A822. $..A\ @ WARRANT ON WRITTEN AC @ it 


DISTRICT 
Urited States Bistrict Court Eastern District of Michigan 


v. 
Any Special Agent of the Federal 


The premises known as 2 
Bureau of Investigation or any 
duly authorized law enforcement 
Affidavit(@é) having been made before me by the beiow-named affiant that he/shmhas reason to believe that (arthe 
parent (onthe promises known es) Pog 
specifically described as a two stor rame house, white in b6 


officer 
on b7c 


inthe___Eastern _—sDistrict of__Michigan there is now being 
concealed certain property, namely computers and computer associated devices such as modem, 
CRT terminals and keyboards, printers, disc drives, tape drives and other input/output 
medium; magnetic media including but not limited to magnetic tapes, discs (hard or floppy); 
all output produced by or caused to be produced by a computer including printer output, 
teletype output or paper tape output; all notes, papers, notebooks, or any other type 
of records associated with or related to computer usage, including address books, desk 
diaries, diaries, directories or any other device used to record i information, addresses, 
and business dealings of unauthorized usage or users of computer networks; and other 
books, papers, ledgers and records which are the fruits, evidence and instrumentalities 
of crime against the United States, that is, wire fraud, in violation of Title 18, United 
os Code, Section 1343, mail fraud, in violation of Title 18, United States Code, 

zon 1341, and conspiracy to commit wire fraud and or mail fraud, in violatim of 
Title 18, United States Code, Section 371. 


and as | am satisfied that there is sul ae jeve that the property so described is being conceale 


person or premises above-described and the grounds for application for issuance of the search warrant exist 
Stated in the supporting affidavitts), 


YOU ARE HEREBY COMMANDED to search on or before of 
(not to exceed 10 days) the person or place named above for the property specified, serving this warrant and making 


the search (in the daytime — 6:00 A.M. to 10:00 P.M.) (atany-timein-the-day-orrigiht)° and if the property be found 
there to seize it, leaving a copy of this warrant and receipt for the property taken, and prepare a written inventory of 
the property seized and promptly return this warrant to ___Magistrate Barbara Hackett 
as required by law. Federal dvdge of U.S. Meguerate 
tr 393 b6 


SIGNATURE OF JUDGE OR US MAGISTRATE OATE/TIME ISSUED b7Cc 


[pantenre’ tC, dae Ot. Ont hh AF | 


“if a search is to be authorizes “at any time in the day or night” pursuant to Federa! Rules of Criminai Procedure Rule 41(c), show reasonable 


ag a 


é RETURN 


o ate WARRANT RECEIVED | DATE AND TIME WARRANT EXECUTED COPY OF wa = ANT ANO 2 PT FOR ITEMS LEFT WITH 
10/11/83 10/12/83 @ 9:00 am | be 


INVENTORY MAOE IN THE PRESENCE OF b7c 


INVENTORY OF PROPERTY TAKEN PURSUANT TO THE WARRANT 
One Atari 400 home computer serial # 020388 
One Atari 410 datarecorder serial # T 48534 
One Atari 850 serial interface serial # AN 146902 
One Bizcomp versamodem serial # B 003948 
One KMC color television set serial # 20505492 
One tan princess telephone 


Ten data casette tapes 


Two boxes of misc. papers 


CERTIFICATION 


| swear that this inventory is a true and detailed account of all the property taken by me on the warrant. 


b6 
Ss 
sf BIC 


Subscribed, sworn to, and returned before me this date. 


/s/ Barbara K. Hackett 10/13/83 
Federal tude or U.S. Maqerree Dove 
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Date of transcription 1/ 5/ 8 4 


The following is a summary of messages left 
by the illegal user on GTE Telemail. The date Pe 
and time of each message 1S provided, with a synopsis Be 
of particularly significant messages included. 


1.) August_15, 1983, 3:19 PM. This message 
reads as follows: you picked the wrong system 
we are supposed to get into C 21267...because 21256 


is a demo system of some sort you can't really do anything ae 
with it. Here is the user name and password. User 
name = Bank; Password = Bank. That password is to 
C 21256. Have_phun! Was I supposed to post that up 
here? Signed * For information C 21267 is 
the Telemail connect address for Citibank in New York 
City. 
2.) August 16, 1983, 10:43 AM. 
3.) August 18, 1983, 11:17 AM. This message 
concerns how to illegally access Wats lines. 
4.) August 17, 1983, 11:04 AM. 
5.) August 18, 1983, 11:26 AM. 
6.) August 14, 1983, 10:24 AM. 
7.) August 14, 1983, 4:45 PM. 
8.) August 15, 1983, 3:17 PM. The subject 
of this message is “Ultimate Rip-off". Text of the 
message is as follows: "It may work or it may not, 
depends on what happens. Q-Who is going to go into 
the banks and pick up the money? Q-If we don't do 
it the way where you_hav © pick up the money in the 
bank where...Signed ie 
9.) August 16, 1983, 10:50 AM. 
10.) August 18, 1983, 11:07 PM. 
12/8/83 Alexandria, Va. Alexandria 196A-633 
investigation on at (at) 2 2 
b6 


sal dss 12/8/83 ste 


by Date dictated 
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it and its contents are not to be distributed outside your agency. 


Fis 225° 


AX 196A-633 2 


August 16, 1983, 3:08 PM. This message 


is from to Subject is "Admin listing". 

The text of the message is "Here is a Admin listing--Admin/IBMLEX, 
P = IBMLEX; Admin/Michigan, P = A; Admin/Unix, P = bé 
Angela; Admin/Amnet, P = Bill; Admin/CCUSA, P = Mary; b7c 


Admin/CWP, P = CWP; Admin/Raytheon, P = Lou. Purge 
this message. Signed ad 


12.) August 18, 1983, 9:10 PM. Subject 
is "Telemail Accounts". Text of the message is "Here 
is some accounts that I created from the other Admins 
accounts...Company user name password..IBMLEX, P. Phreind, 
Phred. CCUSA, M. Mikey, Phred. Unix, J. Crack, Phred. 
Michigan, Dr. Zaphod, Phred. Amnet, A. Phreedmon, 
Phred. Raytheon, J. Jackson, Phred. Telemail, H. Frem, 
Phred. JPL, J. Cargo, Phred. LERC, J. Darda, Phred. 


NSTL, S. Shuttle, Phred.... These are accounts that b6 
I created using the Admin's passwords to the companies. b7c 
Signed , 


13.) August 19, 1983, 8:29 PM. This message 
concerns instructions about how to illegally access 
the computer system known as Dialcom. 


14.) August 20, 1983, 11:14 AM. This message 
also contains instructions on how to access Dialcom. 


15.) August 21, 1983, 1:46 PM. This message 
contains ITT Dialcom passwords. 


16.) August 23, 1983, 12:12 PM. 


17.) August 27, 1983, 2:23 PM. This message 
is titled “Welcome to Bizcomp". The text of the message 
is as follows: "Welcome to the new age of bulletin 
boards. I am the Sysop of the phantsy BBS so if you 
have any remarks about the board or need help on how 
to use it just sent mail to that is me otherwise... b6 
Signed b7c 


18.) August 30, 1983, 4:37 PM. This message 
reads in part "To go undetected in the system I use 
regular user names such as E. Smith or other names 
that are common. 
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19.) August 30, 1983, 4:40 PM. This message 
is from the node Triplex tol yk The 
text of the message is as follows: "I set these accounts 


up with little power of sending so it may work, but 
whatever..[ |" 


20.) September 3, 1983, 3:07 PM. Phe text 
of the message is "Is Telemail going unused? Please 


lets see_ if we can get the system going a bit..O.K. 
Signed Teiemail--Sysop." 


3A7 


b6 
b7c 


b6 
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12/5/83 


Date of transcription 


This 302 reflects a review of evidence seized 
pursuant to a duly au j bé 
the location known as b7c 
a residence of aka 


The following is a summary of paper materials 
and print-outs that are relevant to this investigation: 


1.) Three hand-written pages of names and phone 
numbers beginning with[ 
This list also contains, among others, the names and numbers bé 
eae ER 
b7C 


2.) A long computer print-out containing the 
connect addresses, official name, computer type and system 
type of numerous computer networks, including Arpanet and 
Milnet. 


3.) Thirteen sheets of hand-written notes containing 
Arpanet connect addresses, Milnet connect addresses, Telenet 
connect addresses. Hand-written notes concerning Mitre 
Corporation with a listing of nine user names followed 
by the passwords for each user name. These notes also 
contain numerous other host computer systems and their 
telephone numbers, including Michigan National Bank, Hartford 
College, Arizona State, National Institutes of Health, 
First National Bank of America, J.C. Pennys, Credit Link, 
Sears Credit Line, Union Oil, and F. A. A. 


4.) A sheet of paper with hand-written notes 
concerning Mitre Corporation. This page lists 13 user 
names and passwords associated with Mitre Corporation. Mitre 
Corporation is a host on Arpanet and Mitre Corporation 
is engaged in sensitive Department of Defense research. 


11/17/83 Alexandria, Va. Alexandria 196A-633 Sub¢ 
Investigation ont File #0 
b6 
S aj 11/17/8 b7c 
by A g J Date dictated / v/ 3 
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5.) A sheet of paper with hand-written notes 
on it. These notes refer to McClellan and contain four 
user names with their passwords. McClellan is a United 
States Air Force Base that is a host on the Milnet network. 


6.) A packet (stapled together) of seven pages 
containing hand-written notes. These notes cover a variety 
of topics, including listing calling card numbers. These 
pages also list numerous Telemail user names and passwords, b6 
including -Skylab", and the following listing: b7Cc 


IBMLEX = P. Phreind Password = Joke 
CCUSA = M. Mikey Password = Joke 

UNIX = J. Crack Password = Phred 
Michigan = Dr. Zaphod Password = Phred 
Amnet = A. Phreedmon Password = Phred 
Raytheon = J. Jackson Password = Phred 
Telemail = H. Frem Password = Phred 
JPL = J. Cargo Password = Phred 

LERC = J. Darda Password = Phred 

NSTL = S. Shuttle Password = Phred 


Other hand-written notes on this series of_sheets 

of papers include the words[ sid) «=Innercircle, 

and Another note lists the word Admin/CCUSA, 

followed by Password = Mary. There is also a listing of 

Admin/CWP, Password = CWP, and the words Admin/Raytheon, 

Password = Lou. Hand-written notes also include the name 
= 42739. This is followed 

by the note = T 223 N = Transmit. This is followed by 


the name[ |= 9242. the above 
names and numbers are associated with the number 1-800-426-2222. 


7.) A sheet of paper with hand-written notes 
containing various Telemail hosts, user names and passwords 


as follows: Jobs/AHSC, User = Password = COBE; OSF/NASA, b6 
User = Password = Skylab; UNACRX/Telemail b7c 
User = Password = Apple; CC er = 

Password = A; Admin/Finance, User | Password = A. 


8.) A sheet of paper with hand-written a ae 


b6 
b7c 


followed by the address b6 
This sheet b7C 


= saree | the name followed by the phone number 
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9.) A sheet of paper with hand-written notes 
labelled Telemail Notes, followed by the listing of numerous 
host companies on Telemail, such as NASSA, CCUSA, Raytheon, 
IBMLEX and approximately 30 others. 


10.) Two sheets of paper with hand-written notes 
labelled Arpanet-Notes. These notes consist of connect 
addresses and host names. 


ll.) Two pages of hand-written notes listing 
approximately 50 Telemail users and passwords. The companies 
involved are Coca Cola, USA, NASA, Ford, and a company 
listed as GSFC. 


12.) A sheet of paper with the hand-written words 
Innercircle. 


13.) A sheet of paper with hand-written notes, 
including the following Telemail host systems: Jobs/AHSC 
User = Password = Code; OSF/NASA, User_= b6 
Password = Skylab; UNACRX/Telemail, User = Password Bie 


= Apple: r= Password = A; CCUSA, 
User = Password = A; Admin/Finance, User = 
(eae assword = A. 


14.) A sheet _of paper with a hand-written list 
of names as follows: 


This is a listing pe 
of the users of the illegal node in Telemail known as RES 
the Innercircle. This sheet of acs also bears the name 

15.) A sheet_of paper with the hand-written _notes 
including the goralc 1. followed by the_number 
This shee £ xr i name and the Pp 
name is an employee Bee 


of GTE Telemail. 


16.) A sheet of paper with hand-written notes 
on_it as follows: Admin/Trinex Admin/GTE 


This is followed = oe _ Triplex and 
then the word followed by the word Fone. This b6 
is followed by the word Admin/Triplex, followed by the b7C 


letters FGFGE. The preceding two sets of names were user 
names and passwords in an illegal file in GTE_Telemail. 


t_of pa ins the words 
and 
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17.) A sheet of paper concerning a listing of 
user names and passwords as follows: Admin/Bizcomp, Password 


Dead; Password Fone; Password DOD; 
P Password] 
Password Password Red. 


18.) A re-print of the Global Autovon Telephone 
Directory. 


43! 
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On January 24, 1984, 


a GTE-Telemail, provided a copy of the amount of money BS 
ost by GTE Telema1ii from the unauthorized use by the hackers. ~ bic 
This document is broken down by user and by company. 
Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 
USER COMPANY AMOUNT MONTHS 
[ AHSC $62.29 July, Audust, 
Septemper 
UAW : $31.00 September 
Maraven $16.00 August, September ya, 
Telenet $108.00 July, August 
Lk pati $0,29 September 
$127.58 
[| CBOT $2.00 September b6 
b7c 
rs, RADA $1.00 September 
$3.00 
[| Maraven $24.00 August b6 
b7C 
Telenet $325.00 July 
Telenet $151.00 August 
S48 
aecauiewae 1/25/84 3 Alexandria, Virginia rite e Alexandria 196A~-633 
b6 
SA 2S fk Date dictated ae oy Ay ee 
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FEDERAL BUREAU OF INVESTIGATION 
Oate of transcription 8 l l 9 [ g 3 


was served with a Federal Court Order on 8/19/83, requesting 
her organization to assist the Federal Bureau of Investigation with b6 
the_installation of pen LS or dialed n j Loment BIC 


The court order will expire inf unless an extension b7E 
is obtained. 


, 
wewnnionon 8/19/83 Dn 28-047 =) be 


b7C 
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Date of transcription 
b7D 


the following: 


b6 
b7c 
b7D 


b6 
b7C 
b7D 


Source stated that 


ed that it 313 his opinion tha 


Source stated that 
b6 


b7C 
b7D 
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FEDERAL BUREAU OF INVESTIGATION 


L Oate of Sainz 2e1078% 


This is a summary of the activities ofl] 


[jon GTE Telemail. b6 


b7c 
on GTE Telemail. 
was an illegal user as part of the group 
called “INNERCIRCLE" in AMERICAN HOSPITAL SUPPLY COMPANY b6 
(AHSC), and in RAYTHEON COMPANY. [____lcreated an illegal b7C 
"node" called "BIZCOMP" in RAYTHEON COMPANY. 
to a confidential source that b6 
b7c 
b7D 
routinely provided the user names and 
passwords of legitimate Telemail administrators to other b6 
hackers, giving out as many as seven at one time. He bic 
also created many illegal accounts and provided these 
user names and passwords to other hackers, giving out 
aS many as ten at one time. 
also routinely accessed another Telenet 
host system known as ARPANET (ADVANCED RESEARCH AND PLANNING ane 
AGENCY NETWORK). This is a system designed and set up 
by the DEPARTMENT OF DEFENSE to provide a system for transfer 
of information by companies doing defense related research, 
some of it classified. 
is known to have accessed the Telemail b6 
system at least 25 times between August 15, 1983, and b7C 


September 5, 1983. 


hadedebaneaea 2/6/84 = Alexandria, Va. rie e PLexandria 206A-633 
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b6 
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also known as 
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Copy to: 1 - USA, Alexandria, Va. ise 


FBI/DON 
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NAME OF DEFENDANT: 


[described as: 


Race 
——Sy 


Sex ‘ 
Date of Birth L ie 
Height 

New York. 


ee : 
Driver's License 
Address .. 


oD. 


ceca 


b6 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


2. On October 12, 1983, the premises located at 
, was searched pursuant 
to a duly authorized federal search warrant and various 
computer paraphenalia were seized. 
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WITNESSES: 


i. 


GTE — 


8229 Boone Boulevard 

Vienna, Virginia 

telephonel id 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


Special Agent 
Federal Bureau of Investigation 


Can supply details of investigation. 


i 
Specia gent 


Federal Bureau of Investigation 


Can steely details concerning search off 


Can supply details concerning true 
identity as[ saan use 


of Telemail. 


Full text of interview pages 3 - 4, attached. 


Can supply details of phone conversations_with 
[Lf akal_} at home phone of[_____] 
“E-t 


BY7 


b6 
b7C 


b6 
b7C 


b6é 
b7C 


b6 
b7C 


b6 
b7C 


AX 196A~-633 


EVIDENCE: 
1. A seven-page typed paper with the name Pee 
appearing throughout (original in possession of FBI Alexandria). 


2. Thirty-six messages left by on _ the bé 

i em (original in possession o b7c 
GTE Telemail). 

3. Copy of charges accumulated_b on GTE b6 

Telemail (original in possession of . bic 

b7C 


BUS 


FD-302 (Rev. 3-10-82) r S 


FEOERAL BUREAU OF INVESTIGATION 


1/5/84 


Date of transcription 


The following is a summary of messages left 
by the illegal user using the name[ Jon GTE 
Telemail. The date and time of each message is provided, 


with a synopsis of particularly significant messages 
included. 


1.) August 14, 1983, 11:57 AM. 


2.) August 14, 1983, 12:11 PM. The subject 
of this message is "Trace, Security". The text of 
the message reads in part “We might have a problem. 
There's a good chance that my phone is tapped. Regardless 
we might have to be more careful. Call it paranoia, 
but I think someone is out to get all of us." 


3.) August 14, 1983, 1:47 PM. 
4.) August 14, 1983, 2:12 PM. 
5.) August 14, 1983, 4:31 PM. 


6.) August 15, 1983, 4:02 PM. This message 
reads in part "At the conference tonight we will discuss: 
Cosmos, Ult Rip-off, Blu-Stuff.*" 


7.) August 15, 1983, 4:08 PM. This message 
reads in part "Over the telephone voice calls: Don't 
say anything phreak-related after today! Reasons: 1.) 
There is no reason to because we will have our hands 
full with cosmos and banks for the ult rip-off; 2.) 
We can go "data" instead of voice; 3.) We don't want 
to spread around a lot of info for security reasons. 
The more people that know the less chance of safe success.” 


8.) August 15, 1983, 11:59 PM. 
9.) August 17, 1983, 8:47 PM. 


10.) August 14, 1983, 1:59 PM. 


b6 
b7c 


NS 


Investigation on 


by 


This document contains neither recommendations nor conctusions of the FBI. it is the property of the FBI and is loaned to your agency; 


File # 


12/8/83 Alexandria, Va. Alexandria 196A-633 


sata eT ee 


b6 
b7C¢ 


it and its contents are not to be distributed outside your agency. 
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ll.) August 17, 1983, 2:54 PM. 

12.) August 17, 1983, 8:39 PM. 

13.) August 14, 1983, 11:47 AM. 

14.) August 14, 1983, 11:49 AM. 

15.) August 14, 1983, 2:04 PM. 

16.) August 15, 1983, 6:33 PM. 

17.) August 15, 1983, 8:09 PM. 

18.) August 17, 1983, 8:43 PM. 

19.) August 17, 1983, 8:53 PM. 

20.) August 18, 1983, 8:33 PM. 

21.) August 19, 1983, 12:28 AM. 

22.) August 20, 1983, 10:48 PM. The text 
of this message refers to the user name followed b6 
by pene information fer name] Testiowe bic 
is of the Osuny bulletin board. 

23.) August 20, 1983, 11:07 PM. 

24.) August 21, 1983, 1:01 PM. 

25.) August 21, 1983, 1:03 PM. 

26.) August 21, 1983, 6:13 PM. This message 


is titled "Teleconferencing Numbers". The text of 
the message is as follows: “Here are the girls’ numbers 


b6é 
b7¢ 


That's all." 


27.) August 21, 1983, €:25 PM. 
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28.) August 21, 1983, 8:27 PM. 
29.) August 22, 1983, 9:03 PM. 
30.) 


3 aacressed ta 
the message i 


PM. This message 
The text of 

. The message is 
has been identified as 

phone number obtained for the user name 

Wag subscribed to by a person named 


b6 
b7C 
segue 23, 1983, 5:45 PH. This message 


2.) August 24, 1983, 3:29 PM. 
34.) August 24, 1983, 3:36 PM. 


35.) August 24, 1983, 3:37 PM. 


36.) August 24, 1993, 4:03 PM. 


FD302 (Rev. 3-10-82' - _" ; 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1l/ 31 A 84 


GTE-Telemail, provided a Copy of the amount Of money b6 


lost by GTE Telemail from the unauthorized use by the hackers. b7C 
This document is broken down by user and by company. 


Many of the hackers had two cr more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, Auqust and September 


for eacn comrany): 


USER COMPANY AMOUNT MONTHS 
LT RESC 562.29 July, Augus*, 
Senteamper 


URW S21.60 Septamber 
. b6 
[ Maraven Si6.09 Auaust, September bre 
Telenset Si@s.00 July, August 


3.00 
[ Maraven $24.00 August 
Telenet $325.00 July b6 
b7Cc 
Telenet $151.00 August 
Investigation on 1/25/84 a_ Alexandria, Virginia rites Alexandria 196A-633 
b6 
SA sfk Date dictatea___ 1/25/84 pre 


by 


This document contains neither recommendations nor conclusions of the FB). it isthe property of the FBI and is loaned to your agency; 


Ras. 25d 


it and its contents are not to be distributed outside your agency. 
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Form A. 0. 93. (Rev. Apr. 1973) ee Sch Warrant 
United States Bistrict Court 
FOR THE 


Southern District of New York 


UNITED STATES OF AMERICA Docket No 
Caxe No 
VS. 
THE PREMISES KNOWN AS b6 
SEARCH WARRANTS b7c 
! 
To Any Special Agent cf the Federal Bureau 
Of ‘Investigation or any duly eutrorized Jaw entorcenenc: eriacer 
Affidavit¥s) having been made before me by Special Agent 
. 3 mm the toecsom obi nee ee : b6 
PRs NO BES Leese OUeese es on the premises known os. b7C 
inthe Southern District of New Yors 
there is now being concealed certain property, namely computers an ‘coMbuter aesouiated 
devices such as mcdem, CRT terminals and keyboard: Sc arives, 
tape drives and other input/output mediun; dint? but net 
limited to magnetic tapes, dises (hard or cutput produced bv 
or caused to be produced by a computer inc 2 seainter outpul, teletype 
output or paper tape output; all notes, papers, motcbook Or any cther type 
of records associated with or related to computer usage, one lea ne address 
books, desk diaries, diaries, directories or any other device used io record 
information, addresses and business deslinas of unauthorized useae or users 


of computer networks; and other books, papers, ledgers and records which are 
the fruits, evidence and instrumentalities of crime against the United 


States, that is, wire fraud, im violation of Title 18, United States Coce, 
Section 1345. 


-- @ Se Ces cy @ ~ . bee, 


and as I am satisfied that there is probable cause to believe that the property so described is being 
concealed on the person or premises above described and that grounds for appiication for issuance of the 
search warrant exist as stated in the supporting affidavit (x). 


You are hereby commanded to search within a period of _. ten _(10) days. ______ elle 
(not to exceed 10 days) the person or place named for the property specified, serving this warrant 
in the daytime (6:00 a.m. to 10:00 p.m. \ 
2% An K RPA MK MUX BX HOH EK XX KKK X | 
there to seize it, leaving a copy of this warrant and receipt for the property taken, and prepare a written 
inventory of the property seized and promptly return this warrant and bring the property befor: 


ween ee eee ee ee ee ee eee eee ee as required by law. 
Federal fudge cr maristrase 


and making the search and if the property be found 


Dated this day of OCtover ,19 83 


dudce (Federul or state Court of Kecord) or Federcl Mogusirae 


*The Federal Kules cf Criminal Procedure provide: ‘The warrant chall te served in the daytime. untess the rsuing authority, by anorepriate provisior 
in the warrant, snd for ressonapie cause snown, nutnorizes 1b execuuion al mes other than vavurie.”” (Rule 4i(cr). A siatement of prcunas Ice 702- 
sonable cause should be mace in the affidavit(s) if a search 18 tO be authorized “al any time aay cr nigni” pursuani lo Kwe #iccs. 


ea 


AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 
Your affiant, « , is a 
Special Agent with the Federal Bureau of Investigation and has 
been so employed for years. Your affiant brings this: 
affidavit on information he has received from his personal 
investigation, from information received from Special Agent 


[ane from persons your affiant knows to be 


reliable and trustworthy. 


INTRODUCTION 
General Telephone and Electronics (GTE) owns and 
operates a computer network known as Telenet which links 


various subscriber companies and Government agenices through 


Access is obtained by calling a published telephone number in 
various cities. 

Within the Telenet System is a service called Telemail 
which offers a computerized message capability between Telemail 
customers and any Telemail subscriber company. Each Telemail 
susbscriber is responsible for designating an "in house" 
administrator to oversee all administrative functions of 
the customer's Telemail service, including the assignment of 
passwords to gain access to the system and the subscriber 
company. The administrator for a new user company may set up 
various subdivisions and indvidual users in his own company as 


he sees fit. 


tie-in system in numerous cities throughout the United States. 


b6 
b7C 


Recently, it has come to the attention of GTE that the 
accounts of approximately eighteen Telemail subscribers have 
been accessed by unauthorized intruders from different areas 
of the country. The intruders have gained access to certain 
customers' aevemar subscribers accounts by determining 
passwords assigned to Telemail subscribers through a process 
called “hacking". In this process, a "hacker" chooses a 
subscriber account such as Raytheon, NASA, USDA, RADA Corpora- 
tion, Coca Cola USA, 3M Corporation. The "hacker" then 
begins to try numerous successive passwords (e.g., each letter 
of the alphabet, or the administrater's first hae: etc.) 
until the correct password is, discovered. Many hackers program 
their home computer to systematicaily try passwords for hours 
at a time. Once a hacker has broken a terminal's password, 
he can now enter the Telemail system as if he were the 
legitimate subscriber. He would do this by calling any 
published Telenet dial in number and then placing his telephone 
on his modem hookup. This modem hookup now allows him to 
type on his home computer keyboard and have the impulses sent 
through the telephone system into the Telenet computer 
system. He then types in the command "Mail" and enters the 
Telemail mailing system. At this point the computer prompts 
him with "User Name?". He then types in the words (for example) 
ADMIN/NASA. The computer then prompts with "Password?" 
and he then types in the password that he has discovered 


through hacking. At this point he is accepted by the system 


360 


: " & 


as a legitimate subscriber, and may perform many of. the 
functions that the subscriber can perform, all of which would 
be charged to the legitimate subscriber. At this point the 
hackers create a pirate subdivision in the legitimate 
subscriber organization, such as ADMIN/inner circle/NASA 

and then set up user names in that new "pirate" account. 

User names may be any compilation of letters and numbers but 


are usually a first initial, period, then last name (l.e., 
b6 


[. The hacker, as administrator of his own b7c 


subdivision, now sets up passwords for all his users, notifies 
them of their user name and password and they can now enter 
Telemail with their names and passwords. These users may 

now leave messages on the austen to an individual -in the 
group, to the pirate administrator or (because the computer 
believes they are legitimate) to any other user (legitimate or 


illegitimate) in the entire Telemail system. 


Ble! 


‘ @ 


PROBABLE CAUSE 
1. On approximately August 23, 1983 GTE Telemail 
discovered an unauthorized user in the account of their 
customers, Raytheon ecnpany and American Hospital Supply 
Company (AHSC). This person has been using the fictitious 
name[__ sand was accessing Telemail through dialin aa 
number 914/3299199, which is in the Scarsdale, New York 


area. 


. ? b6 
told Special Agent[ FBI, that a review of b7c 
messages in AHSC shows that[ has been uSing the 


account of AHSC since at least August 16, 1982 and has 


entered the Telemail system at least 55 times, the latest 


Cal 


being detected on September 22, 1983 and September 23, 196 
in the accounts of NASA and RADA Corporation, respectively. 
3. ‘Special Agent[ das received information from b6 
b7Cc 
a confidential source, who has provided reliable information 
in the past, said information being confirmed by Special 


agent[ ana which information has led to an arrest 


on one occasion. This source stated to Special Agent b6 
b7C 


a ep 


————————EEEEEes 
22522332] 
pT 


Aor 


4. Investigation by the FBI indicates that the telephone 


CF Frther, b6 

b7C 
a person by the name[OOO*Y: date of birth 
[resides at that address. 


a4 It is common for the "hacker" to have an additional 
phone line in the residence to be used for the computer 


modem. There is, in fact, an additional phone line (number 


=o 
6. [in a message left on the Telemail 


Signed the message with the name[ | 


7s On October <, 1963 Special agent[ called 
the number[ sana asked if[_Jwas there. The 


woman who answered the phone said that[ _ was not. an at 


b6 
b7C 


that time. 

8. Due to the continuing nature of the offense, that is, 
the devising of a scheme or artifice to defraud GTE, 
Raytheon and AHSC through the use of computers and computer 
related equipment over a telephone at a given location, your 


affiant believes that the fruits and instrumentalities of 


b7C 


262 


9. Based on all of the above facts, your affiant submits 


that there is sufficient probable cause to believe that this 


on going offense is located at the premises known as[__] 6 


the Southern District of New York. At that location are 
computers and computer related paraphernalia, records, 
documents, papers, and notes which are the fruits, evidence 
and instrumentalities of an offense against the United States, 


that is, wire fraud in violation of Title 18, United States 


a 


Code, Section 134 


. 


Special Agent 
Federal Bureau of Investigacion 


Sworn to before me and subscribed in my 
presence this day of October, 1983. 


UNITED STATES MAGISTRATE 
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FEDERAL BUREAU OF INVESTIGATION 


L Date of transcription 2/10/8 4 


This is a summary of the activities off 
on GTE Telemail. Ke 


[ijusea the name[ on Telemail. PAS 


He was registered as an illegal user in AMERICAN 
HOSPITAL SUPPLY COMPANY (AHSC) and RAYTHEON COMPANY. 


In his messages,|______——_—id|discussed among other b6 
things such projects as "the Ultimate Rip-off" in reference 


b7C 
to the Telemail computer account of CITIBANK OF NEW YORK. 
is known to have accessed the Telemail b6 
system at least 36 times between August 14, 1983, and b7Cc 
August 24, 1983. 
jueensatan da 2/6/84 at_._ Alexandria, Va. Fie se Alexandria 196A-633 


b6é 
by sAP Fa cate aicttea_2/6/84 BIC 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is toaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Gate of transcription 1/3 0/8 4 


fj——— a —— ; was advised of 


b6 
lt oe — Z b7C 
the official identity of the interviewing agent and thereafter 
orovided the collowing 2.ntormation: 
He used the namef on che Osuny bulletin 
noard during the summer of 1983. While looking at messages 
en this bulletin cward,[>]was able to see a private 
message Left for inorher narty on that board. This message PS 
was from someone using the name el ana the message De 
stated something =o tne urfcen thac “vou can call me at 
laldg se called the number once 
to see if it was a2 working number and a male answered. 
rs Se A@ iid not say anythina, put simply hung 
ID. 
ee ee sAi0 chat ait im -:Lectronics snow 
2th OEE EEO Le BEE Sy Swe Minusiast whose fir: b6 
name ne) 2c SG GSES Sue nae b7c 
the Telemall system und 7c} : 
oWELCUME MeESGage vil 
s@€is: ne used the Teiemail service 
20 eee Four or Dive times and in doing so communicated bé 
( amew to Rave a real Zirst name of b7c 
and 
a er stated that ne did not know 
tnat the messages ne was leaving on Telamail were being mes 
bllled to another comrany. Ue thougnt that semehow this 
WAS an electronic connection to a fource iccount or a 
Compuserve accounrn ine tnat a person would pe billed through 
Source or Compuserve once vou nave connected with those 
computers. 
also provided the following identifying 
information: 
b6 
Date of Birth: ; b7c 
Age: 
Social Security 
Account Number; [ 
evetnecttaras 1/25/84 7 Alexandria, Va. rieglexandria 196A-633 
b6 
by SA aj Date dictated 1/2678 4 b7c 


This document contains neither recommenaations nor conclusions of the FBI. It is the property of the F Bi and is loaned to your agency; 
it ana its contents are not to de distributed outside your agency. 
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Height: 
Weight: b6é 
Eves: bic 
Hairs: 
le 
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valso known 


b6e 
b7C 


Copy to: 1 - USA, Alexandrj bé 
(Attn: AUSA ) b7c 


FBI/DOU 
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NAME OF DEFENDANTS: 


2 ey eee 


b6 
Race b7c 
Sex 
“Date of Birth 
Address" 


ae 


oe 
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Race ie 
SEX ae 
Date of Birth 

Address... ~ 
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3. [i described as: 


Race 
Sex 
‘pate _of Birth 
social. .Secur ity 
“Aecount- Number 


[] y" b6 


b7c 
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4. [ described as: 


_Race- 
Sex 
Date. _Birth 
Address 


ert 


2 


b6 
b7C 


5. [tf described as: 


Race C 

’ Sex ; \ {2 b6 

Date of Birth b7c 
Address 


any 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


2. On October 12, 1983, the premises located at: 


were searched 


pursuant to a duly authorized federal search warrant and 
various computer paraphenalia were seized. 


28 
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WITNESSES: 
l. 


Telemal 
8229 Boone Boulevard b6 


Vienna, Virginia b7c 
Telephone | _] 

Can provide details of GTE Telemail operations, 

methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


2. b6 
Special Agent b7c 
Federal Bureau of Investigation 


Can supply details of investigation. - 


5. [ 
Special Agent 


Federal Bureau of Investigation b6 
Los Angeles b7Cc 


Can —— details ee search off 


4. 
Special Agent 
Federal Bureau of Investigation b6 
Los Angeles b7c 
Can ae details concerning searches inl 
Bis 
b6 
b7c 


through personal knowledge. 
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EVIDENCE: 


1. List of four messages left b on Telemail 
(original in possession of 
[cece GTE Telemail). 

2. Summary of relevant evidence seized in search 
at carte lee possession of FBI Alexandria). 

3. Summary of information found on "floppy discs” 
seized in search (discs in possession of FBI Alexandria) 


List of charges attributable | 
(original in possession of GTE Telemail). 


. List of 39 messages left on GTE Telemail by 


ay Oe in possession off ip. 
2. Summary of relevant evidence seized in search 
a(S *di in possession of FBI 


Alexandria). 

3. List of charges attributable to aka 
ee in possession o GTE 
Telemail). 


4. Summary of trap and trace information received 


1. List of 67 messages left b on GTE Telemail 
(originals in possession of GTE Telemail). 

2. Summary of relevant evidence seized in search 
FBI Alexandria). 


3. Summary of information found on "floppy discs” 
seized in search (discs in possession of FBI Alexandria). 


. List of charges attributa aka[ | 
ne Coe in possession of : 
- Summary of trap and trace information received 
from ; 
at AQ 


b6 
b7C 


b6 
b7C 


b6 
b7c 


b6 
b7c 
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es of eight messages left on Telemail by[ | 


(originals in possession of 


2. Summary of relevan vi nce seized in search 


of (in possession of 
FBI Alexandria). 


3. Summary of information found on "floppy discs" 
seized in search (discs in possession of FBI Alexandria). 


4. List of charges attributable tol ss—siszY 


(original in possession of 


5. Summary of trap and trace information received 


b6 
b7C 


b6 
b7C 


b6 
b7C 
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FEDERAL BUREAU OF INVESTIGATION 


12/15/83 


Date of transcription 


The following is a of messages left_by the 
iicewigeee deine hacen ens 
on GTE Telemail. The date and time of each message 15 BIC 
provided with a synopsis of particularly significant messages 


included. 


1) August 27, 1983, 11:47 p.m. (Eastern Standard Time) 
2) August 30, 1983, 4:04 a.m. (Eastern Daylight Time) 


3) September 3, 1983, 4:01 a.m. This message is from 
[____}Prono/Ray theoy to Admin. Message reads, b6 
Orgot my other Pr I'll have b7c 


to check it out with 
4) September 10,1983, 9: p.m. 


javestidetionenes 2/9/83 a Alexandria, Virginia cies Alexandria 196A-633 
. b6 
by SA btl Date dictated 12/9/83 bic 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription Y, 2 0/ 84 


The following is a listing of evidence pertaining 
to the illegal intrusion into GTE Telemail found at the bé 
‘premises known as B7C 
This is the residence o 


1.) A computer print-out listing 38 syste 
users beginning with account number one belonging to 
a i , 


b6 
b7Cc 


and others. 


2.) Numerous copies of a magazine newsletter 
called "Tap". These newsletters contain information on 
defeating alarm systems and numerous articles on how to 
avoid paying legitimate charges to the phone company. 


3.) A computer listing which lists the contents 
of a floppy disc. A sample of the contents listed are 
as follows: T 001 B. Telemail less than 9, T 005 B. Telemail 
less than 13, T 005 B. Telemail plus 4.1 less than 9, 
T 003 B. Telemail less than 13. 


4.) A 3* X 5" card with the following words 


5.) A 3" X 5" card with the word Autonet, followed Bue 
by C 21311. This card also contains umber 
800-424-9096, followed by the words Please”. 
6.) A 3" X 5" card which, on one side contains 
the name followed by the phone number 
(W) and (H). On the reverse of this card b6 
are the following words: Telemail (T@Mail): Username: b7c 
DCLNBB, password: Bill, followed by the words "use help". 
Also found on this side of the 3" X 5" card are the words 
followed by break system. 
7.) A 3" X 5" card which_contains the number 
eee, followed by the name On the b6 
reverse of this card the word is found and the number b7c 
jnvestigationoa 1/17/84 at__ Alexandria, Va. ceie ALexandria 196A-633 
by SA aj Date dictated 1/17/84 bé 
b7c 
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8 A computer print-out which is signed by Be 
the user b7c 


b6 
b7C 


by the numbers 
this number 
is followed 


y 
and also the number Also f is sheet 
of paper are the numbers and 


10.) _A sheet of 8” X 10" white paper i 
bears the name[ sand the phone number 
b6 
11.) A computer print-out titled 7 an b7¢C 
ae 


Card Access Numbers and signed alias" 


12.) A copy of the Uninet network access phone 
by state. 


This paper also has the name and the b6 


he verse of this sheet b7¢c 


phone n er 
of paper is found the_n 


by the phone number 
ofl} aka 


14.) A copy of “revised tymnet phone numbers". 


15.) A green sheet of paper from a spiral note 
book with handwritten words as follows: TRW, Arpanet, 
Milnet, TVETLINK-Telnet. 

16.) 


A_computer print-out with three messages 


to 
message is 
and the other two are 


b6 
b7c 


17.) A computer print-out with a number of 


messages on_ it, one of which is from This message ee 
refers to The other_two users on this computer Hae 
print-out are and 


BY 


AX 196A-633 3 


18.) A computer print~-out with one message bs 
starting "Hi[l FF and ending] sg b7C 


19.) A copy of the Oklahoma Modem Users Grou bé 
Newsletter, dated September 1, 1983, and signed ey — 
20. A 3" X 5" card which bears the handwritten b6 
name b7C 
21.) A white 3" X 5* j contains the 
ae | but_it is spelled followed by 
the phone number This number was given b6 
to a confidential source b and the confidential b7C 
source was told that b7D 


The customer name and address for this number 


22.) A 3" X_5*" card eet has the name[ sf b6 


Lollowed by the number b7Cc 


23.) A 3" X 5% 


[Jana the phone_number 
phone number for 


This 3" X 5" card also contains the name 


ntains the initials 
This is the home 


b7c 
followed by the following numbers: , 
fe Se Lao 
b6 
b7¢c 


It is dated September 


25.) The remnants of a 3" X 5" card that had 
been torn into numerous pieces. When placed back together 
the writing on the 3" X 5" card reads as follows: The 


check is good. I swear_it! Don' ry checking for fingerprints, pe 
‘ b7C 
I'm careful. Signed, 
Also seized in the search were items labelled 
paraphenalia, which appear to be homemade pipes and tubes 


for smoking marijuana. 


Also seized was a switchblade knife. 


yer OS: 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 1/ 3 0/ 8 4 


On October 12, 1983, a du i 
Warrant was executed at the address 
Leese! the home of The Oppy b6 
1scs at were seized pursuant to the search warrant b7¢c 
were examined byl a computer programmer. 


Following is a summary of the information that Lebowitz 
found on these discs. 


On the disc labelled 196-633 Sub ee 

Number One, is found a program calle TELENET." 
This 1s a listing of various telenet host connect addresses. b6é 
A program called "Numbers" contains a message from b7c 


abou ne numbers. is_a nickname for 
and alias o The program called 
Pay Phone" contains a message on how to misuse or abuse 


pay phones. 


On the disc labelled 196-633 Sub 7 ae 
a Number 2 is a program called "Hack. Sprint. 
1S 1S a program to find Sprint access codes. Three programs 
titled “Hack. MCI.", “Hack. ITT.", and "Hack. METRO.", b6 
were designed to hack out MCI, ITT, and Metrophone authorization b7C 
codes respectively. A program called "Hacker II" is designed 
to find access codes for many different long distance systems. 
A program called "Codes MCI" is a listing of MCI access 
codes actually found. A program called "CODES SPRINT" 
is a list of Sprint codes actually found. 


On the disc labelled 196-633 Sub G, 1Bl, 


L___} is found a program called "JOLOY 1" This b6 
contains numerous messages from a bulletin board. These b7c 
messages include numerous passwords as well as numbers 


given to "Phreak on Telenet." A program called "JOLOY 
II" is a listing of connect addresses on different systems 
on telenet. One of the systems is listed as "Allied Corp 


Confidential." A program called "OSUNY" contains information 
Investigation on 7, 13/ 84 at Alexandri Vi ini Files Alexandria — 
196A-633 


Sub 


by sAT i mbe ate aictatea __1/13/8.4 ve 


b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


ra a 23ly 


AX 196A-633 2 


b6 


from on MCI credit card access methods. ee 


It also contains information on a magazine called "Tap" 
devoted to phreaking on phones. 


The disc labelled 196-633 Sub G, 2 | 
/ Number 4, contains a program called 
TITLES. This program is a listing of various messages 
from a bulletin board. The program called "B. INT CALLS 
W/BLUE BOX - 29" contains a message from the phantom concerning 
how to use a blue box device for free overseas phone calls. 
A program called "B. Telemail - 5" contains a message 
from concerning a new bulletin board 
that he has set up within the telenet system. _The program 
called "B. MITRE - 5" contains a message from 
giving passwords for the MITRE Corporation Computer 
on Arpanet. (The program called {__—jo0004. mari" contains b6 
a message to from Jupiter - FBN. This program b7Cc 
provides an identification name and password for a computer. 
A program called "D. DANGER! - 3" contains a message from 
[____ to all users warning of people being searched 
y authorities. The program called "B. TELENET?? - 9" 
contains a message from to everybody concerning 
Telenet. The program called "B. TELNET (NOT GTE - TELENET) 
- 18" contains a message i) en ree everyone 
to make sure to purge their messages. The program called 
"B. AUTONET - 26" contains a message from 
to all concerning a new network called "AUTONET." This 
message also asks for an Arpanet Access Code. 


The disc labelled 196-633 Sub G, I1Bl, 
Number 5, contains a program labelled 
"B. MASS. GEN, HOSPITAL - 14." This program contains a 
message from on how to use telemail am 
called "B. ARPANET - 5" contains a message from 
on how to get into Arpanet from Telenet. The 


rogram called "“AUTOVAN'ERS - 31" contains a message from b6 
ot ee how to dial into the Autovan Network. b7c 


The program called "B. SCC'S - 5" contains a message from 
[about phone numbers for a customer 
service of the “Lesser Known FCC's." The program called 
"B. ITT DIALCOM NETWORK - 5" contains information from 


on the ITT Dialcom Network at how 
to enter the network. The program called "B. WHO CARES" 


AX 196A-633 3 


contains a listing of telenet connect addresses from _| 
The program called "B. TRW - 19" contains 
a message from about a TRW Computer 


System he found. The_program called "B. TRAVEL-NET - 29" 
contains a note gron[ on how to find access 


codes to Travelnet. The program _ called "B. WRONG!I!!!1! bé6 
- 29" contains a message from abeut how to b7c 
use a "phone trunk." A program called "B. NOTES ON SKYLINE 


~ 5" contains a message from about 


finding codes for Skyline. i rogram called = CODACAS 
~ 1" contains a message fromn[| ~~ Jabout how 


to play a "On-line" computer game. 


The disc labelled 196-633 Sub G, isi, [ bé 
Number 6, contains a message labelie b7c 
"PHREAK 932" which contains numerous messages from a home 
bulletin board. 


The dise labelled 196-533 Sub G, I1Bl, 
Number 8, contains a program called b6 
"OLD DATAPAC." This program contains a message from[_| bic 


about a Canadian electronic system called 
DAT? 
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FEOERAL BUREAU OF INVESTIGATION 


Cate of transcription ly 3 L/ 84 


LL GTE-Telemail, provided a copy of the amount of money 
fs) 


st by GTE Telemail from the unauthorized use by the hackers. BTC 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
{this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS _ 
[ AHSC $62.29 July, August, 
September 
UAW $31.00 September 
7 , b6 
[| Maraven 916.00 August, September yo, 
Telenet $108.00 July, August 
[st BMW $0.29 September 
$127.58 


. . . . . . ° . . . . . ° . . . . . . ° . . . - . . . . 


[ CBOT $2.00 September bé 
b7C 
Co RADA $1.00 September 


[| Maraven $24.00 August 

Telenet . $325.00 July b6 

b7c 
Telenet $151.00 August 
* : - 
Investigation on _if2 5/84 ___ a Alexandria, Virginia rye. Alexandria 196A-633 
by SA bsfk Date aictatea___- 1/25/84 CG 
: b7C 
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@ w tisdasniptonac 27 19783. 
The following is a_summ es left by the b6 
illegal user using the eh GTE Telemail. b7C 


The date and time of each message is provided, 
with a synopsis of particularly significant messages included. 


1) September 14, 1983, 9:50 p.m. (all times Eastern 
Daylight Time) 

September 14, 1983, 9:07 p.m. 

September 14, 1983, 9:57 p.m. 

September 15, 1923, 12:29 a.m. Thi 
in part, "I have been poking ar 
some neat info." 


=o 
Nw Ne 


S$ messazme reads 
ound and T've cot 


5) September l1é, pe le ee 

6) September 1°, Ry20 aor 

7) September 1£, $ mae 

S September 15, g & 
MWe de sec Si \ 

G} Séptember 1°, LOPS gn ge aes Tee Thle messare reads, Bus 
"CUZ 4, Bons. Asve (an BHeeCr er Oye ot Se 
(Oale “Indust eiess ow! 

10) September 19, 195? 


WAAL 


ty 


La be ibe 


ao follows 3 
I found my way 


: . ee 
weyernauser, ! 


eo) 
BY mMoOChSer wos 
you don't nav 
EPS CET yn “Ge a 
& 


+ } i PAW - 
TNenisS Som we 


i} Sentemeer 19, .- 
pees sectemper 20, 15 
13) Sentember 21, 2% 
art am up to oe 
ana = have ov 
2,506 numbers 
computers in 
. See 
Investigation on ee SPS? at Lieyvandria, eae vce Eilecs Ve enovs a 
PIs VIS b6 
ns Date dictated af 2 


This document contains neither recommendations nor conclusions of the FBI. It is tne property of the FBI and 1s loaned to your agency: 


it and its contents are not to pe distributed outside your agency. 


str AqY 


61a, LIAUMTM™ OS 


Continuation of interview of the an@enises GQ , Page ys 


12) September 21, 1983, 12:05 a.m. 

13) September 21, 1983, 12:07 a.m. 

14) September 21, 1983, 12:19 a.m. 

15) September 21, 1983, 1:40 a.m. 

16) September 22, 1983, 2:28 a.m. 

17) September 22, 1983, 2:30 a.m. This messade reacs, 
"Read this anc then loc back in and read a MSG 
that I left for you too: Admin/Promo. Also, 

say _hi_ to for me." Siqned 


b6 


SC ‘ 
ee. b7C 


September 21, 1983, 10:53 p.m. This messaqe reads, 
"Think about it, cuz momma wants me to play with 
her crecit. (Or at least check it)" 


bh 
co 


19) Senmtember 22, 1903, 2:20 a.m. 
20) September 22, 1983, 2:23 a.m. 
21} September 24, 19€3, 11:12 a.m 
22) September 24, 1953, 9:41 pom. 
23) Sertember 24, 1983, 9:48 p.m. 
24) September 25, 1962 2429 a.m. 
25% September 25, L963 1203: per. 
26) September 25, 1983, 2:33 a.m. 
27) September 25, 1983, 1:06 p.m. 
28) September 26, 1963, 1:06 a.m. 
29) September 26, 1963, 10:39 n.m. This messace reads, 


"That is okey. Cuz I decided that the SCPP Poard 
was enough. JI will just try to hack out somenocy 
else's PWD. (I downloadec the hele user list anc 
the whole Admin. List. Gee, wouldn't it be funny 


if I nackec the PY for Adamin/TeLlemail!!??)' 
30) September 27, 19623, 9:1l p.m. . 
31) September 27, 1963, 9:13 p.m. 
32} September 22, 1943, 9:17 ren. 
Pee September 27, 19¢27, 19:06 147. This mesesadr readn 
‘in part, "Well, you have finally mace it to the most 


elite BBS there is. Telemail. Ec not mention names 
ro anythine else on here, just in case the FEI wante’ 
to make an example of the qrour. (SCPP)" 


34) September 26, 1923, 9:13 p.m. 
35) September 29, 193, 12:46 a.m. 
36) September 29, 19¢c3, 1:01 a.m. 
27)! October 1, 1982, 12:05 mom. 
38) October 2, 19823, 2:42 a.m. 


Ags 


AX 196A-633 ® @ 


"The Anarchist" 3 


ontinuation of interview of , Page 
39) October 7, 1983, 9:52 p.m. This message reads, b6 
"Well, as far as I know, is no b7c 


longer a member of the SCPP. 
should delete him." Signed 


Sie 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12/ L/ 8 3 


The following is a summary of a review of the 


evidence seized in a duly_authorized search warrant conducted 


at the residence known as 
This is the home address of 


The following is a summary of evidence that is 
relevant to this case. All evidence from print-outs, etc., 
were obtained from a single black three ring binder. The 
following items were contained within that binder: 


(1) 


(2) 


(3) 


(4) 
(5) 


A computer print-out with approximately 
30 metro phone access codes. 


A lined sheet of paper with 32 names 

and numbers written on it. Of particular 
interest is number 03 which reflects the 

followed by the phone 

numbers and Number 04 


is followed_by th 
number poth[ and 
were illegitimate users of the Telemail 


System and the node known as SCPP. This 
sheet of paper also contains the names 

with telephone 
It also contains the 
and the phone number 
These previous people were also 
the subject of searches conducted by the 

FBI on October 12, 1983. 


A computer print-out listing approximately 
20 MCI access codes. 


A list of Telemail commands. 
f paper bearing 


Underneath that 
the telephone number 


An unlin 
the name 
is the name 


b6 
b7C 


b6 
b7C 


b6 
b7Cc 


investigation on_LL/15/83  — aAlexandria, Virginia ries Alexandria _—_ 


» saa 
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196A-633 


it and its contents are not to be distributed outside your agency. 


arr 34] 


Date dictated 11/15/83 | _— ___b6 
b 


7c 


AX 196A-633 


(6) 


(7) 


(8) 


(9) 


(10) 


2 


A computer print-out with a list titled, 
"Users SCPP."_ That list then lists the names 


b6 
b7Cc 


A computer print-out labeled Telenet Admins. 
This is approximately 20 pages that apparently 
lists every Telemail administrator. 


A computer print-out that has the w 

Arpnet and the telephone munber[ | Be 
written on it. This is followe y wha noe 
appeared to be commands to access a host. 


A multiple page computer print-out that 

begins " Presents ... the b6 
Complete Telenet Access Port Directory." b7c 
This is followed by an extensive listing 

of what appeared to be very Telenet access 

dial in number. 


A computer print-out with additional 
handwritten notes on it. The notes began 
"558" and then the word prefix followed 

by approximately 50 four digit numbers. 

Some of these four digit numbers have the 
word Telenet written next to them. This 
computer print-out also contains the word 
nodes followed by the term Raytheon Promo- 
Promo and then the word "Bang" then the word 
SCPP. This print-out also contains the 
handwritten word nodes TRW. Both Raytheon 
and TRW were Telemail host companies that were 
illegally penetrated by Hackers. 


na § 
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FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 


Date of transcription 


A review of the “flo disk" seized durin 
SugesrohMor tne fasidence aR bé 
revealed that there was nothing on b7c 


the oppy disk that pertained to Telemail or any other 
illegal activities. 


1/10/84 Alexandria, Va. Alexandria 196A-633 


Investigation on at Fite # 


b6 
sa F835 W/l/ed re 
by 


Date dictated 
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FEDERAL BUREAU OF INVESTIGATION 


Oate of transcription ly 3 1 VA 84 


On January 24, 1984, 
GTE-Telemail, provided a copy of the amount of money — 
er 


This document is broken down by user and by company. 


Many of the hackers had two cr more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 


b7C 


[ BMY SO6,29 Septemoer 


$127.58 


e . . « ° ° . ° . . . . . . . . . . . . . . . . . . . . . ° . . . . 


b7C 
Co RADA 51.00 September 


$3.00 

[| Maraven $24.00 August 

Telenet $325.00 July 66 

Telenet . $151.00 August bie 
Se Ld 
investigation on 1/25/84 a Alexandria, Virginia rier Alexandria 196A-633 
by SA pSfk Dateaictatea__ 1/25/84 iB 

, b7C 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12 1 9 5 


The following is_a_summa of messages left by b6 
the illegal user known as[- on GTF Telerail. b7c 


The date and time of each message is provided 
with a synopsis of particularly significant messages included. 


1) September 13, 1983, 9:51 p.m. (All times Eastern 
Daylight Time) 


2 September 14, 1903, 1:15 a.r. 
3) September 14, 1933, 1:27 a.m. 
4) September 14, 1965, 12:23 a.m. 


5) September 15, 1983, 1:48 a.m. This messedqe reads 
in part, "Well, I have only read a few msas that 
were not addressed to the SCPF. Most of the time 
I get the ‘info. withheld for privacy' crap. I'm 
gonna keep trying though.” 
CG) September 14, 1983, 6:25 p.m. This message reads, 
"Well, what do you think? Remember that there may 
always be someone up there watching, so be careful 
what you say. Try to access all _ the neato things 
you can, okay? I'll talk to wnen I can. 
7) September 14, 1933, 10:41 p.m. This message reads, 
“Watch wnat you Say on here. Bic Brother right ke 
watching. Like, don't use people's first names 
and stuff. Neat system, huh?" 

SSeptember 15, 1963, 1:55 a.m. This messace reacs, 
"Well, we now obviously have a creat incentive 
for foot new members. (Guess) I already told b6 


b6 
b7C¢ 


tt 


cS 


but we neec to start coing for recruitment b7c 
ast before this thing goes out. and I were 
even talking about setting up a private SCPP Board 
in someone's house after awhile." 
9) September 16, 1983, 2:15 a.n. 
10) September 16, 1983, 7:37 p.m. This messace reads, 
"I'd like to talk to you about a few thinas. Is 


it all richt if I call you? I ha rour Ph#, mine 
isf and my name is if vou bé6 


wanna call me.” b7C 
11) September 17, 1983, 2:14 a.m. 
12) September 17, 19383, 3:10 a.m. 


12/13/83 Alexandria, Virginia Alexandria 196A-63: 


File # 
Sub G 


at 


Investigation on 


12/13/83 b6 


Oate dictated. ee 
b7c 


btl 


by 


This document contains neither recommendations nor conclusions of the FBI, It is the property of the FBI and is ‘oaned to your agency; 
it ana its contents are not to be distributed outside your agency. 


. | P26 yt , 


AX 196A-633 Sub G 
b6 
tet of : : 2 b7c 
Continuation of interview of (PBQO os a 


13) September 17, 1983, 2:25 p.m. 

14) September 17, 1983, 4:36 p.m. 

15) September 15, 1983, 9:06 p.m. 

16) September 15, 1983, 9:11 p.m. 

17) September 16, 1983, 2:15 a.m. 

18) September 16, 1983, 12:51 a.m. 

19) September 16, 1983, 12:55 a.m. 

20) September 17, 1983, 5:48 p.m. 

21) September 17, 1983, 5:54 p.m. This message reads, 
"Don't worry, I don't think there is anything to 
worry about BECA; system interrupt mode;;; I know 
who you are. You should know better! Telemail 
deleting user: SYS 3471874/CUT TYelemail disconnected 
at 13:35 49 49 47 4 c," 

22) September 17, 1983, 5:56 p.m. This message reads, 
"Did you know that if you do a shift control P 
anywhere that it will put you into Telenet and still 
be connected to Telemail? Then you do a CONT at the 
Prompt... later.” , 

23) September 17, 1983, 6:02 p 

24) September 17, 1983, 6:37 p 

p This message reads, 
£ 


W miu < 
2niLlS 


25) September 18, 1983, 6:18 p. 
"I need some addresses for VAX on Telenet. 
message is asking for connect addresses for a 
particular type of computer system (VAX) on Telenet. 

26) September 18, 1983, 11:06 p.m. This messace reads, 
"No I don't have a new method of hackine VAX LAMG, 
it is called someone qave me some passwords, Jesus 
Christ, why couldn't you have just given them to me 

. without having to ask such a lame question?" 

27) September 20, 1983, 2:10 a.m. 

28) September 20, 1983, 10:20 p.m. 

29) September 21, 1983, 1:01 a.m. 

30) September 21, 1983, 1:05 a.m. 

31) September 21, 1983, 6:22 p.m. 

32) September 21, 1983, 11:13 p.m. 

33) September 22, 1983, 1:48 a.m. 

34) September 21, 1983, 6:32 p.n. 

35) September 21, 1963, 9:22 p.m. 

36) September 21, 1963, 7:21 


P 
37) September 22, 1983, 8:00 mem. 
38) September 22, 1983, 8:05 p.m. 
39) September 23, 1983, 12:58 a.m 
40) September 23, 1983, 1:07 a.m. 
41) September 22, 1983, 9:29 pom. 


AX 196A-633 Sub G 


“Continuation otintervowot_ [age 


42) 


ee ed 


ON ONO CN Tm oN 
Hm OM iH Ow} 


September 22 
to:[ jane reads, 


b6 
3 b7c 

1983, 10:16 p.m. This message is b6 
"Can you please tell me b7c 


how to make free calls?" 


September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 
September 

in part, 


12:58 a.m. 
1:02 a.m. 
1:02 a.m. 
12:23 p.m. 
1:07 a.m. 
6:09 p.m. 
1:10 a.m. 
2:31 a.m. 
11:57 a.m. 
12:39 a.m. 
2:02 a.m. 
11:25 a.m. 
6:20 a.m. 
12:44 a.m. 
1:00 a.m. 
11:54 p.m. 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1963, 
1983, 
1983, 
1963, 
19€3, 
1983, 
1963, 
1983, 
1983, 


26, 1983, This messaaqe reads 


"The major ackers are probably becinning 
make a name for themselves and this scares them, 
so they trv to do anvthing they can to disrupt this.” 


September 
September 
September 


_ September 


September 
September 
September 
October 1, 
October 4, 


19€3, 10:40 a.m. 
1983, 12:32 a.m. 
1933, 1:34 a.m. 
1963, Dem. 
1963, : a.m. 
1963, 6: p.m. 
1933, p.m. 
1983, 10:25 a.m. 
1983, €:29 p.n. 


b6 
b7C 


Und 
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FEDERAL BUREAU OF INVESTIGATION 


11/28/83 


Oate of transcription 


The following is a report of a review of evidence 
seized pursuant to a duly authorized Federal Search Warrant 66 
snducted at the residence known ——— be 
— This is the residence o aka 


The following is a summary of the evidence contained 
on hand-written sheets of paper and computer print-—outs: 


A computer print-out beginning with the words — 
d containing a sign-off as follows,[ _| - 


b7C 
2.) Two sheets of paper with the words,[ | 


[sd printed out on it. 


3.) <A two-page computer print-out titlea[ | 
Telenet Addreses. This contains numerous connect b6 
addresses and names of various telenet hosts including Citibank 7¢ 
Cash Manager, Nasa Reconnaisance and E.F. Hutton. 


4.) <A computer print-out titied| ___| Tetenet 
Aecess Codes. This consists of numerous connect addresses bé 
and names of host systems, including Nasa Reconnaisance, b7c 
Stanford university, Dartmouth Collere and Irving Trust Cash 
Register. 


5.) A eon al = numerous names and phone bé 
aumerss including telephone number — 


6.) This is a computer print-out of a message from 
dated 9/17/83, listing a source account and 
password and three other computer accounts and passwords. 


b6 
b7c 
computer print-out containing a message left 
by dated July_10, no year, Ji ia 1e 
codes and access numbers. [is 
the subject of a search in s matter. 
~ 4- 7 A. 
lavestigation on 11/17/83 a Alexandria, Virginia cue Alexandria 196A-633 
Sub G 
-oat Q 
by SA 58 pate aictatea____ 11/17/23 si 
. b7c 
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104 


AX 196A-633 Sub G 2 


8.) A computer print-out with a messag 
dated 9/9/83, stating in part, "My number: e 
Underneath the number is hand-written the word 


b6 
9.) A sheet of white paper with the word b7c 
written on it fo wed by the word Carrier - and then 
the word Voice - 


10.) <A sheet of white paper with the hand-written 
ote on it "Real Names: 


b6 
b7C 
11.) This is a computer = t 
win m nd (e] bers: 
a aie) 
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FEDERAL BUREAU OF INVESTIGATION 


1 1/16/84 
ead Date of transcription 

During the months of November and December, bé 
Cy a coliputes peogcamiets ‘euaninea ee 
various software an floppy disks" in connection with 
this case. 

[| founa the following information that RE 
is of interest: Bit 

On the "floppy disk" labelled 196-633-Sub G 
1B2, Number 7, the words "Osuny BBS ‘text'" is found. When 
this floppy disk was placed in the computer it revealed 
the following information: Under the title "File2", b6 
found various and assorted messages from a home "bulletin BIC 
board". These messages includea listing of various credit 
card long distance access numbers and instructions on 
how to break into a computer system known as RSTS. 

In a section labelled "MSG3*, found bé 
assorted messages from a bulletin board. found bic 
additional messages from a home bulletin board in sections 
labelled "MSG5" and "MSG6". 

1/10/84 Alexandria, Va. Alexandria 196A-633 


Investigation on at File # 


b6 
sds yin/ss ap 
by 


Date dictated 


if 
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FEDERAL BUREAU OF INVESTIGATION 


i Oate of transcription i/l 6/8 4 
ized in the search of 
the residence of 
one duo fone dialer. This is a hand-held b6 
evice which simulates the tones produced by a touch tone b7c 
phone. This type of device is often used by hackers and 
phone phreaks to by-pass billing procedures used by the 
phone company and obtain free long distance phone calls. 
1/10/84 Alexandria, Va. af Alexandria 196A-633 
investigation on a ite # 


b6 


: saAL_—~—~—~sCSCéitdé GG; 1/11/84 b7C 
¥ 


Date dictated 
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Date of transcription 1 f 3 1 A 8 4 


On January 24, 1984, 


[i GTE-Telemail, provided a copy of the amount of money a 
lost by GTE Telemail from the unauthorized use by the hackers. 
This document is broken down by user and by company. 
Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicatina totals by %ach user, combining multiple user names 
(this summary covers the months of July, August and September 
For @acn company): 
USER COMPANY _ AMOUNT MONTHS 
[ ARSC $62.29 July, August, 
September 
UAT $31.00 September 
- b6 
[| Maraven Sl6.00 August, September b7c 
Telenetr $108.00 July, August 
| pits 50,29 September 
$127.58 


[ CBOT $2.00 September b6 


b7C 
[ RADA $1.00 September 
$3.00 
[ Maraven $24.00 August 
Telenet $325.00 July b6 
b7C 
Telenet $151.00 August 
suv Go | 
Investigation on 1/25/84 __ a Alexandria, Virginia Fite « Alexandria 196A 196A-633 
by SA sfk Date dictated _ 1/25/84 i 
. b7C 
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Date of transcription 12/ 19 / 83 


The following is a sv of messages left by the oe 
illegal user known a don GTZ Telemail. The . 
date and time of each message is provided with a synopsis of 
particularly significant messages included. 


1) September 17, 1983, 7:24 p.m. 

2) September 24, 1983, 1:07 a.m. 

3) September 24, 1983, 2:58 a.m. 

4) September 24, 1983, 2:54 a.m. 

5) September 27, 1983, 9:21 p.m. This message reads 
in part, “We decided that the party will start 
at 11:00 and this is for the SCPP Members who 
want to join. Then around 12:30 we will start 
the distribution of the newest stuff! We will 
have about five or six computers. One will be 
displaying Telemail for the new SCPP Members, 
one will be used for Prom-Blasting." 

6) September 28, 1983, 1:07 p.m. 

7) October 9, 1983, 2:21 p.m. 

8) October 9, 1983, 2:22 p.m. 


taveitinationswe7 227 83 Alexandria, Virginia cuee Alexandria 196A-633 


b6 


SA btl Wie ditivindist Lal 3yes b7C 


by 
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FEDERAL BUREAU OF INVESTIGATION 


L 12/9/83 


Date of transcription 


This report is a review of evidence seized pursuant 
to a duly authorized Federal Search Warrant executed at 
the residence known as b6 


on October 12, 1983. _ _ is = a of b7c 
| | ona L 


The following is a summary of hand-written notes 
or printed information of relevance to this investigation: 


1.) A white sheet of paper containing a hand-written 
note beginning with the words "Hi boys" and ending with 
the signature “Love Dad". A quote from that letter is 
as follows, "You told me about your ability to access other 
computers with the phone and right after you left those 
computer raiding stories developed. Some of those kids 
could get into a lot of trouble. I hope you two are using 
good judgement and not doing that type of thing. Think! 
I know you will.” 


2.) A yellow scrap of paper with the words[ | 


[sprinted on it. b6 


b7C 
3.) A yellow sheet of paper with the words[ | 


[sprinted on it. 


4.) A computer print-out containing instructions 
about how to use a Telemail account. 


5. A_computer print-out containing a message ase 
from dated September 17, 1983, in which he 7s 
gives a source account, user name and password. 


6.) Two sheets of lined paper with hand-written 
notes listing names and_ph b The names and number 
include the followin 


b6 
b7C¢ 


11/17/83 


at. Alexandria, Va. rie eslexandria 196A-633 


investigation on 


o—___Saf esa pate sictstea__11/17/83 ae 


b7C 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to pe distributed outside your agency. 


esr 4D \ 


FD302 (Rev. 3-10-82) ‘ . 
FEDERAL BUREAU OF INVESTIGATION 


i 1/16/84 


Date of transcription 


Review of evidence seized in the search of 
the residence of b6 


revealed_a brown manilla envelo with b7C 
isted as 


investigati 1/10/84 ; Alexandria, Va. auentexandria 196A-633 
nvestigation on a ie # 

b6 
by SA a3 Date dictated 1/11/84 bie 
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1 Oate of transcription__ 1/30/84 


Subsequent to a search pursuant to a duly authorized 


Federal Search Warrant at the residence known as 


the residence of ae 
a computer programmer, examined 
the oppy discs" that were seized in this search. 
following is a summary of the information 
that found_on those discs. On the disc labelled b6 
196-633-Sub G 1B-3, Number Two, a program called b7c 
"MCI Place. MW" was found. This program contains an 800 
phone number and a list of MCI access codes. Another program 
on that disc was called "Passwords. MW." This program 
contains phone numbers of bulletin boards as well as individuals. 
It also contains MCI, Metrofone, and ITT access codes. The 
next program on this disc was called "Names." This contained 
a listing of administrators for the GTE telemail network. 
investigation on 1/13/84 at__ Alexandria, Virginia rieAlexandria  —s_ 
196A-633 
SubG 
bys SA mbe Date atctatea__1/ 13/84 
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Oate of transcription l/ 3 L/ 8 4 


On January 24, 1984,[7 be 
L___] GTE-Telemail, provided a copy of the amount of money b7c 


ost by GTE Telemail from the unauthorized use by the hackers. 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


(iSER COMPANY AMOUNT MONTHS 


[ AHSC $62.29 July, Auqust, 


September 


UAL $31.00 September 
. . b6é 
[| Maraven 916.00 August, September yy. 
Telenet $108.00 July, August 
[ BMW $0.29 September 
$127.58 


[ CBOT $2.00 September bé 
. b7C 
[ RADA |. $1.00 September 


$3.00 
[| Maraven $24.00 August 
Telenet $325.00 July b6 
b7C 
Telenet $151.00 August 
Investigation on 1/25/84 a Alexandria, Virginia rie ew Dlexandria 196A-633 
b6 
by SA , rf sfk Date dictatea 1/25/8 5/8 4 
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i 2/13/84 


Oate of transcription 


This is a summary of the activities off sd BS 


on GTE Telemail. b7C 


was an unauthorized user in the accounts of RADA CORPORATION, 


b7C 
AHSC, and RAYTHEON COMPANY. 


He accessed the Telemail System at least 18 times 
from approximately August 27, 1983 to September 10, 1983. 


true name and home phone number were provided B6 
to the FBI by confidential source. Bue 
Investigation on__L/31/84 a_Alexandria, Virginia File s__ Alexandria 


196A-633 Sub G 


b6 
ne OT siecle 272785 ee 
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FEDERAL BUREAU OF INVESTIGATION 


i Date of wanseription 2723/84 


This is a summary of the activity ofL—‘iq|SSCPS 
on GTE Telemail. 


b7C 
[___jusea the name[____yand he was part of b6 
a group known as SCPP and was an unauthorized user in the b7c 
account of RAYTHEON COMPANY. 
accessed the Telemail System at least b6 

39 times between September 14 and October 7, 1983. b7c 
b7E 
b6 
b7C 


1/31/84 Alexandria, Virginia Alexandria 
Investigation on_____ a at, File. # —1-062—633—Seb—G— 
b6 
ssl 2/2/08 
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Date dictated ak ea 
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FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription _ 2/1 3/84 —_ 
The following is a summary of the activity of b6 
on GTE Telemail. b7c 
used the name[ sana was part bé 
of a group known as SCPP, which was an unauthorized "node" bic 
in the account of RAYTHEON COMPANY. 
accessed the Telemail System at least b6 


67 times from approximately September 13, 1983, to October 4, 1983. b7c 


In a messa S ember 16, 1983, he_states, b6 
"My phone number is and my name is[ |" 


b7C 
T d trace record bIE 
b6 
b7Cc 
Investigation on 1/31/84 _ at Alexandria, Virginia. _File +» __Alexandria ___ 


196A-633 Sub G~ 


by Date dictatea____- 2/2/84 
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Bs Date of transcription —__2/ 13/7 
This is a summary of the activity of____— ae 


b7C 


on GTE Telemail. 
used the name 


and were unauthorized users in the account of RAYTHEON 
b6 


COMPANY. 
accessed the Telemail System at }7¢ 
1983 to October 10, 1983. 


least 44 times from September 15, 


b7C 


— 
~~ 
. 0 . - a 
investigation on__2/31/84 sg, Alexandria, Virginia 0) Alexandri 
b6 
b7c 
» 
by SA plw Date dictated 2/2/84 
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